deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5703
Published: 2018-04-03
Description: Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-269
References: http://www.securitytracker.com/id/1040626; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00087&languageid=en-fr; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-3638
Published: 2018-04-03
Description: Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a privileged user.
CVSS Score: 7.8 (HIGH)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr
CVE: CVE-2018-3641
Published: 2018-04-03
Description: Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user.
CVSS Score: 9.8 (CRITICAL)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr
CVE: CVE-2018-3645
Published: 2018-04-03
Description: Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboard session.
CVSS Score: 7.8 (HIGH)
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00122&languageid=en-fr
CVE: CVE-2015-1975
Published: 2018-04-03
Description: The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM Security Directory Server 6.3.1 before iFix 11 and 6.4 before iFix 2 allows local users to gain privileges via vectors related to argument injection. IBM X-Force ID: 103694.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74
References: http://www-01.ibm.com/support/docview.wss?uid=swg21960659; http://www.securityfocus.com/bid/103717; https://exchange.xforce.ibmcloud.com/vulnerabilities/103694
CVE: CVE-2017-17742
Published: 2018-04-03
Description: Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-113
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103684; http://www.securitytracker.com/id/1042004
CVE: CVE-2017-3972
Published: 2018-04-03
Description: Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security relevant information.
CVSS Score: 8.3 (HIGH)
CWE: CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-4028
Published: 2018-04-03
Description: Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74
References: http://www.securityfocus.com/bid/97958; https://kc.mcafee.com/corporate/index?page=content&id=SB10193; http://www.securityfocus.com/bid/97958
CVE: CVE-2018-6914
Published: 2018-04-03
Description: Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103686; http://www.securitytracker.com/id/1042004
CVE: CVE-2018-8049
Published: 2018-04-03
Description: The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=48; http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=48
CVE: CVE-2018-8777
Published: 2018-04-03
Description: In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103683; http://www.securitytracker.com/id/1042004
CVE: CVE-2018-8778
Published: 2018-04-03
Description: In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103693; http://www.securitytracker.com/id/1042004
CVE: CVE-2018-8779
Published: 2018-04-03
Description: In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103767; http://www.securitytracker.com/id/1042004
CVE: CVE-2018-8780
Published: 2018-04-03
Description: In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; http://www.securityfocus.com/bid/103739; http://www.securitytracker.com/id/1042004
CVE: CVE-2018-9240
Published: 2018-04-03
Description: ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugs.debian.org/894724; https://lists.debian.org/debian-lts-announce/2020/04/msg00020.html; https://usn.ubuntu.com/4507-1/
CVE: CVE-2018-8941
Published: 2018-04-03
Description: Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v. 1.01 has a buffer overflow, allowing authenticated remote attackers to execute arbitrary code via a long Addr value to the 'set Diagnostics_Entry' function in an HTTP request, related to /userfs/bin/tcapi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/SECFORCE/CVE-2018-8941; https://github.com/SECFORCE/CVE-2018-8941
CVE: CVE-2018-9234
Published: 2018-04-04
Description: GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
CVSS Score: 7.5 (HIGH)
CWE: CWE-320
References: https://dev.gnupg.org/T3844; https://usn.ubuntu.com/3675-1/; https://dev.gnupg.org/T3844
CVE: CVE-2018-9247
Published: 2018-04-04
Description: The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql parameter. Consequently, an attacker can execute arbitrary PHP code by placing it after a <?php substring, and then using INTO OUTFILE with a .php filename.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-getshell/index.html; http://www.atksec.com/cve/GxlcmsQY-v1.0.0713-getshell/index.html
CVE: CVE-2016-10718
Published: 2018-04-04
Description: Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/brave/browser-laptop/issues/5006; https://github.com/brave/browser-laptop/issues/5007; https://hackerone.com/reports/176197
CVE: CVE-2017-18256
Published: 2018-04-04
Description: Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code, because window dialogs are mishandled.
CVSS Score: 6.5 (MEDIUM)
References: https://hackerone.com/reports/176066; https://www.exploit-db.com/exploits/44474/; https://hackerone.com/reports/176066
CVE: CVE-2018-9251
Published: 2018-04-04
Description: The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.gnome.org/show_bug.cgi?id=794914; https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html; https://bugzilla.gnome.org/show_bug.cgi?id=794914
CVE: CVE-2018-9252
Published: 2018-04-04
Description: JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html; https://github.com/mdadams/jasper/issues/173
CVE: CVE-2018-9235
Published: 2018-04-04
Description: iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/caQW37fY; https://www.exploit-db.com/exploits/44434/; https://pastebin.com/caQW37fY
CVE: CVE-2018-9236
Published: 2018-04-04
Description: iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/Amw08sAj; https://www.exploit-db.com/exploits/44436/; https://pastebin.com/Amw08sAj
CVE: CVE-2018-9237
Published: 2018-04-04
Description: iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/9C0QBs8u; https://www.exploit-db.com/exploits/44436/; https://pastebin.com/9C0QBs8u
CVE: CVE-2018-9238
Published: 2018-04-04
Description: proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/ia7U4vi9; https://www.exploit-db.com/exploits/44424/; https://pastebin.com/ia7U4vi9
CVE: CVE-2018-9256
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14467; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dac48f148538c706c446e5105d84ebcb54587528; https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE: CVE-2018-9257
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-cql.c by checking for a nonzero number of columns.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14530; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d7a9501b0439a5dbf24016a95b4896170d789dc2; https://www.wireshark.org/security/wnpa-sec-2018-22.html
CVE: CVE-2018-9258
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14472; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=2d4695de1477df60b0188fd581c0c279db601978; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9259
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursion depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13777; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=[PII_REDACTED]b37549f245ac7c05ff2b96276893e4; https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE: CVE-2018-9260
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14468; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=14d6f717d8ea27688af48532edb1d29f502ea8f0; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9261
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14471; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=66bc372716e04d6a8afdf6712583c9b5d11fee55; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9262
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesting to restrict the recursion depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14469; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f05c3b91f9571210b86576ee6284e71a3306109d; https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE: CVE-2018-9263
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length.
CVSS Score: 7.5 (HIGH)
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14576; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4fe65168fd0de[PII_REDACTED]0aa414f10f53cbdf0; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9264
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-adb.c by checking for a length inconsistency.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14460; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=0290a62be0fca8da9bb190f59dc1fe26c1d65024; https://www.debian.org/security/2018/dsa-4217
CVE: CVE-2018-9265
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14480; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b12cc581cd4878d74b6116ca02c7dbe650c1f242; https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE: CVE-2018-9266
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-isup.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14481; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9d3714e767cb104dcfa1647935fa5960b16bb8e1; https://www.wireshark.org/security/wnpa-sec-2018-24.html
CVE: CVE-2018-9267
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14482; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8ed057f7faa709dbde34b91f0715a957837f74d9; https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
CVE: CVE-2018-9268
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14483; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c69d710d2bf39fe633800db65efddf55701131b6; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9269
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14484; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e19aba33026212cbe000ece633adf14d109489fa; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9270
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14485; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=0fbc50f9b9219be54d6db47f04b65af19696a7c7; https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
CVE: CVE-2018-9271
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14486; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=5b0228945dc74ee82d2ab4a4e7af2bdfe7b75910; https://www.wireshark.org/security/wnpa-sec-2018-24.html
CVE: CVE-2018-9272
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14487; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=6e3b90824a82724f445a0374e99f0b76e4cf5e8b; https://www.wireshark.org/security/wnpa-sec-2018-24.html
CVE: CVE-2018-9273
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14488; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=1f8f1456f1e73b6c09e50a64749e43413ac12df7; https://www.debian.org/security/2018/dsa-4217
CVE: CVE-2018-9274
Published: 2018-04-04
Description: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14489; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=211845aba4794720ae265c782cdffddae54a3e7a; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f38e895dfc0d97bce64f73ce99df706911d9aa07
CVE: CVE-2017-18096
Published: 2018-04-04
Description: The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://ecosystem.atlassian.net/browse/APL-1359; https://ecosystem.atlassian.net/browse/APL-1359
CVE: CVE-2017-3964
Published: 2018-04-04
Description: Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-3965
Published: 2018-04-04
Description: Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-3966
Published: 2018-04-04
Description: Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-613
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-3967
Published: 2018-04-04
Description: Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2017-3969
Published: 2018-04-04
Description: Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
CVSS Score: 8.2 (HIGH)
CWE: CWE-417
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10192