deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-3711
Published: 2018-06-07
Description: Fastify node module before 0.38.0 is vulnerable to a denial-of-service attack by sending a request with "Content-Type: application/json" and a very large payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/fastify/fastify/pull/627; https://hackerone.com/reports/303632; https://github.com/fastify/fastify/pull/627
CVE: CVE-2018-3712
Published: 2018-06-07
Description: serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/zeit/serve/pull/316; https://hackerone.com/reports/307666; https://github.com/zeit/serve/pull/316
CVE: CVE-2018-3713
Published: 2018-06-07
Description: angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/309120; https://hackerone.com/reports/309120
CVE: CVE-2018-3714
Published: 2018-06-07
Description: node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file with known path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/309124; https://hackerone.com/reports/309124
CVE: CVE-2018-3715
Published: 2018-06-07
Description: glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to read content of any file with known path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19; https://hackerone.com/reports/310106; https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19
CVE: CVE-2018-3716
Published: 2018-06-07
Description: simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/309648; https://hackerone.com/reports/309648
CVE: CVE-2018-3717
Published: 2018-06-07
Description: connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/senchalabs/connect/commit/6d5dd30075d2bc4ee97afdbbe3d9d98d8d52d74b; https://hackerone.com/reports/309394; https://hackerone.com/reports/309641
CVE: CVE-2018-3718
Published: 2018-06-07
Description: serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-177
References: https://hackerone.com/reports/308721; https://hackerone.com/reports/308721
CVE: CVE-2018-3719
Published: 2018-06-07
Description: mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-471, CWE-20
References: https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c; https://hackerone.com/reports/311236; https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c
CVE: CVE-2018-3720
Published: 2018-06-07
Description: assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-471
References: https://github.com/jonschlinkert/assign-deep/commit/19953a8c089b0328c470acaaaf6accdfcb34da11; https://hackerone.com/reports/310707; https://github.com/jonschlinkert/assign-deep/commit/19953a8c089b0328c470acaaaf6accdfcb34da11
CVE: CVE-2018-3721
Published: 2018-06-07
Description: lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-471, CWE-1321
References: https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a; https://hackerone.com/reports/310443; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-3722
Published: 2018-06-07
Description: merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-471
References: https://github.com/jonschlinkert/merge-deep/commit/2c33634da7129a5aefcc262d2fec2e72224404e5; https://hackerone.com/reports/310708; https://github.com/jonschlinkert/merge-deep/commit/2c33634da7129a5aefcc262d2fec2e72224404e5
CVE: CVE-2018-3723
Published: 2018-06-07
Description: defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS Score: 8.8 (HIGH)
CWE: CWE-471, CWE-20
References: https://github.com/jonschlinkert/defaults-deep/commit/c873f341327ad885ff4d0f23b3d3bca31b0343e5; https://hackerone.com/reports/310514; https://github.com/jonschlinkert/defaults-deep/commit/c873f341327ad885ff4d0f23b3d3bca31b0343e5
CVE: CVE-2018-3724
Published: 2018-06-07
Description: general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/310943; https://hackerone.com/reports/310943
CVE: CVE-2018-3725
Published: 2018-06-07
Description: hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/311218; https://hackerone.com/reports/311218
CVE: CVE-2018-3726
Published: 2018-06-07
Description: crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/omphalos/crud-file-server/commit/4155bfe068bf211b49a0b3ffd06e78cbaf1b40fa; https://hackerone.com/reports/311101; https://github.com/omphalos/crud-file-server/commit/4155bfe068bf211b49a0b3ffd06e78cbaf1b40fa
CVE: CVE-2018-3727
Published: 2018-06-07
Description: 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/311216; https://hackerone.com/reports/311216
CVE: CVE-2018-3729
Published: 2018-06-07
Description: localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/312889; https://hackerone.com/reports/312889
CVE: CVE-2018-3730
Published: 2018-06-07
Description: mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/312907; https://hackerone.com/reports/312907
CVE: CVE-2018-3731
Published: 2018-06-07
Description: public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/312918; https://hackerone.com/reports/312918
CVE: CVE-2018-3732
Published: 2018-06-07
Description: resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/pillarjs/resolve-path/commit/fe5b8052cafd35fcdafe9210e100e9050b37d2a0; https://hackerone.com/reports/315760; https://github.com/pillarjs/resolve-path/commit/fe5b8052cafd35fcdafe9210e100e9050b37d2a0
CVE: CVE-2018-3735
Published: 2018-06-07
Description: bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/317125; https://hackerone.com/reports/317125
CVE: CVE-2018-3736
Published: 2018-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-3739.  Reason: This candidate is a duplicate of CVE-2018-3739.  Notes: All CVE users should reference CVE-2018-3739 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-3737
Published: 2018-06-07
Description: sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-185
References: https://hackerone.com/reports/319593; https://hackerone.com/reports/319593
CVE: CVE-2018-3738
Published: 2018-06-07
Description: protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-185
References: https://hackerone.com/reports/319576; https://hackerone.com/reports/319576
CVE: CVE-2018-3739
Published: 2018-06-07
Description: https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-400, CWE-125
References: https://hackerone.com/reports/319532; https://hackerone.com/reports/319532
CVE: CVE-2017-6779
Published: 2018-06-07
Description: Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maximum size restriction. Therefore, the file is allowed to consume the majority of available disk space on the appliance. An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable. This vulnerability affects the following Cisco Voice Operating System (VOS)-based products: Emergency Responder, Finesse, Hosted Collaboration Mediation Fulfillment, MediaSense, Prime License Manager, SocialMiner, Unified Communications Manager (UCM), Unified Communications Manager IM and Presence Service (IM&P - earlier releases were known as Cisco Unified Presence), Unified Communication Manager Session Management Edition (SME), Unified Contact Center Express (UCCx), Unified Intelligence Center (UIC), Unity Connection, Virtualized Voice Browser. This vulnerability also affects Prime Collaboration Assurance and Prime Collaboration Provisioning. Cisco Bug IDs: CSCvd10872, CSCvf64322, CSCvf64332, CSCvi29538, CSCvi29543, CSCvi29544, CSCvi29546, CSCvi29556, CSCvi29571, CSCvi31738, CSCvi31741, CSCvi31762, CSCvi31807, CSCvi31818, CSCvi31823.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-diskdos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-diskdos
CVE: CVE-2018-0263
Published: 2018-06-07
Description: A vulnerability in Cisco Meeting Server (CMS) could allow an unauthenticated, adjacent attacker to access services running on internal device interfaces of an affected system. The vulnerability is due to incorrect default configuration of the device, which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files and sensitive meeting information on an affected system. This vulnerability affects Cisco Meeting Server (CMS) 2000 Platforms that are running a CMS Software release prior to Release 2.2.13 or Release 2.3.4. Cisco Bug IDs: CSCvg76471.
CVSS Score: 7.4 (HIGH)
CWE: CWE-16, CWE-1188
References: http://www.securityfocus.com/bid/104419; http://www.securitytracker.com/id/1041065; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cms-id
CVE: CVE-2018-0274
Published: 2018-06-07
Description: A vulnerability in the CLI parser of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting malicious arguments into vulnerable commands. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the affected system. This vulnerability affects the following releases of Cisco Network Services Orchestrator (NSO): 4.1 through 4.1.6.0, 4.2 through 4.2.4.0, 4.3 through 4.3.3.0, 4.4 through 4.4.2.0. Cisco Bug IDs: CSCvf99982.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-78
References: http://www.securityfocus.com/bid/104449; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-nso; http://www.securityfocus.com/bid/104449
CVE: CVE-2018-0296
Published: 2018-06-07
Description: A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-22
References: http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html; http://www.securityfocus.com/bid/104612; http://www.securitytracker.com/id/1041076
CVE: CVE-2018-0315
Published: 2018-06-07
Description: A vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device or cause the affected device to reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are running Cisco IOS XE Software Release Fuji 16.7.1 or Fuji 16.8.1 and are configured to use AAA for login authentication. Cisco Bug IDs: CSCvi25380.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/104410; http://www.securitytracker.com/id/1041086; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-aaa
CVE: CVE-2018-0316
Published: 2018-06-07
Description: A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the firmware of an affected phone incorrectly handles errors that could occur when an incoming phone call is not answered. An attacker could exploit this vulnerability by sending a set of maliciously crafted SIP packets to an affected phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly, resulting in a temporary DoS condition. This vulnerability affects Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware if they are running a Multiplatform Firmware release prior to Release 11.1(2). Cisco Bug IDs: CSCvi24718.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-755
References: http://www.securitytracker.com/id/1041073; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-multiplatform-sip; http://www.securitytracker.com/id/1041073
CVE: CVE-2018-0317
Published: 2018-06-07
Description: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges. The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an access request. An exploit could allow the attacker to promote their account to any role defined on the system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvc90286.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-862
References: http://www.securityfocus.com/bid/104432; http://www.securitytracker.com/id/1041080; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass
CVE: CVE-2018-0318
Published: 2018-06-07
Description: A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploit this vulnerability by submitting a password reset request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07245.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255, CWE-287
References: http://www.securityfocus.com/bid/104434; http://www.securitytracker.com/id/1041082; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-reset
CVE: CVE-2018-0319
Published: 2018-06-07
Description: A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password recovery request. An attacker could exploit this vulnerability by submitting a password recovery request and changing the password for any user on an affected system. An exploit could allow the attacker to gain administrative-level privileges on the affected system. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd07253.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255, CWE-287
References: http://www.securityfocus.com/bid/104431; http://www.securitytracker.com/id/1041079; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-password-recovery
CVE: CVE-2018-0320
Published: 2018-06-07
Description: A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. Cisco Bug IDs: CSCvd61754.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/104416; http://www.securitytracker.com/id/1041084; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-sql
CVE: CVE-2018-0321
Published: 2018-06-07
Description: A vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system. The vulnerability is due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI system on an affected PCP instance. An exploit could allow the attacker to perform malicious actions that affect PCP and the devices that are connected to it. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 11.6 and prior. Cisco Bug IDs: CSCvd61746.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/104409; http://www.securitytracker.com/id/1041085; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-rmi