rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-7452 
A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T06:00:00.000Z
CVE-2018-7453 
Infinite recursion in AcroForm::scanField in AcroForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file due to lack of loop checking, as demonstrated by pdftohtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T06:00:00.000Z
CVE-2018-7454 
A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T06:00:00.000Z
CVE-2018-7455 
An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T06:00:00.000Z
CVE-2018-7456 
A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-24T06:00:00.000Z
CVE-2018-7463 
SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T13:00:00.000Z
CVE-2018-7465 
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-26T19:00:00.000Z
CVE-2018-7466 
install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T07:00:00.000Z
CVE-2018-7467 
AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T21:00:00.000Z
CVE-2018-7469 
PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php (aka Categories - Industry Type).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T15:00:00.000Z
CVE-2018-7470 
An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of service (segmentation violation) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T07:00:00.000Z
CVE-2018-7471 
KingView 7.5SP1 has an integer overflow during stgopenstorage API read operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T07:00:00.000Z
CVE-2018-7472 
INVT Studio 1.2 allows remote attackers to cause a denial of service during import operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T07:00:00.000Z
CVE-2018-7473 
Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-07T15:00:00.000Z
CVE-2018-7474 
An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-14T14:00:00.000Z
CVE-2018-7475 
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-30T14:00:00.000Z
CVE-2018-7476 
controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T19:00:00.000Z
CVE-2018-7477 
SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T07:00:00.000Z
CVE-2018-7479 
YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T03:00:00.000Z
CVE-2018-7480 
The blkcg_init_queue function in block/blk-cgroup.c in the Linux kernel before 4.11 allows local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-25T20:00:00.000Z
CVE-2018-7482 
The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloads
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T07:00:00.000Z
CVE-2018-7484 
An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T02:00:00.000Z
CVE-2018-7485 
The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T14:00:00.000Z
CVE-2018-7486 
Blue River Mura CMS before v7.0.7029 supports inline function calls with an [m] tag and [/m] end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an [m]$.dspinclude("../pathname/executable.jpeg")[/m] approach, where executable.jpeg contains ColdFusion Markup Language code. This can be exploited in conjunction with a CKFinder feature that allows file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T14:00:00.000Z
CVE-2018-7487 
There is a heap-based buffer overflow in the LoadPCX function of in_pcx.cpp in sam2p 0.49.4. A Crafted input will lead to a denial of service or possibly unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T15:00:00.000Z
CVE-2018-7489 
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T15:00:00.000Z
CVE-2018-7490 
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T22:00:00.000Z
CVE-2018-7491 
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors' values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T17:00:00.000Z
CVE-2018-7492 
A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-26T20:00:00.000Z
CVE-2018-7493 
CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-05T20:00:00.000Z
CVE-2018-7494 
WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Delta Electronics WPLSoft
Published: 2018-05-04T19:00:00.000Z
CVE-2018-7495 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified, which may allow an attacker to delete files.
Problem types: cwe_id: CWE-73
description: EXTERNAL CONTROL OF FILE NAME OR PATH CWE-73
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7496 
An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header and referrer-policy response header each provide unintended information disclosure.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: OSIsoft PI Vision
Published: 2018-03-14T18:00:00.000Z
CVE-2018-7497 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several untrusted pointer dereference vulnerabilities have been identified, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7498 
In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
Problem types: cwe_id: CWE-311
description: MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Affected products: vendor: Philips
product: Philips Alice 6 System
Published: 2018-03-28T17:00:00.000Z
CVE-2018-7499 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several stack-based buffer overflow vulnerabilities have been identified, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7500 
A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: OSIsoft PI Web API
Published: 2018-03-14T18:00:00.000Z
CVE-2018-7501 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several SQL injection vulnerabilities have been identified, which may allow an attacker to disclose sensitive information from the host.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7502 
Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.
Problem types: cwe_id: CWE-822
description: Untrusted Pointer Dereference CWE-822
Affected products: vendor: ICS-CERT
product: Beckhoff TwinCAT PLC products
Published: 2018-03-23T17:00:00.000Z
CVE-2018-7503 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a path transversal vulnerability has been identified, which may allow an attacker to disclose sensitive information on the target.
Problem types: cwe_id: CWE-22
description: PATH TRAVERSAL CWE-22
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7504 
A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: n/a
product: OSIsoft PI Vision
Published: 2018-03-14T18:00:00.000Z
CVE-2018-7505 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a TFTP application has unrestricted file uploads to the web application without authorization, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-264
description: IMPROPER AUTHORIZATION CWE-264
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-7506 
The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attacker to decrypt encrypted information.
Problem types: description: Information Exposure
Affected products: vendor: ICS-CERT
product: Moxa MXview
Published: 2018-04-06T14:00:00.000Z
CVE-2018-7507 
WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: ICS-CERT
product: Delta Electronics WPLSoft
Published: 2018-05-04T19:00:00.000Z
CVE-2018-7508 
A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: OSIsoft PI Web API
Published: 2018-03-14T18:00:00.000Z
CVE-2018-7509 
WPLSoft in Delta Electronics versions 2.45.0 and prior writes data from a file outside the bounds of the intended buffer space, which could cause memory corruption or may allow remote code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: ICS-CERT
product: Delta Electronics WPLSoft
Published: 2018-05-04T19:00:00.000Z
CVE-2018-7510 
In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are presented in plaintext in a file that is accessible without authentication.
Problem types: cwe_id: CWE-256
description: UNPROTECTED STORAGE OF CREDENTIALS CWE-256
Affected products: vendor: ICS-CERT
product: BeaconMedaes TotalAlert Scroll Medical Air Systems web application
Published: 2018-06-06T20:00:00.000Z
CVE-2018-7511 
In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow remote execution of arbitrary code.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: Eaton
product: Eaton ELCSoft
Published: 2018-03-20T16:00:00.000Z
CVE-2018-7512 
A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which may allow remote code execution.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: Geutebr&#195;&#188;ck
product: Geutebr&#195;&#188;ck G-Cam/EFD-2250 (part n&#194;&#176; 5.02024) firmware and Topline TopFD-2125 (part n&#194;&#176; 5.02820) firmware
Published: 2018-03-22T18:00:00.000Z
CVE-2018-7513 
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a stack-based buffer overflow.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Omron CX-Supervisor
Published: 2018-03-21T20:00:00.000Z
CVE-2018-7514 
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a stack-based buffer overflow.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Omron CX-One
Published: 2018-04-17T19:00:00.000Z
CVE-2018-7515 
In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectly calls an initialized pointer when parsing malformed packets.
Problem types: cwe_id: CWE-256
description: UNPROTECTED STORAGE OF CREDENTIALS CWE-256
Affected products: vendor: ICS-CERT
product: BeaconMed&#195;&#166;s TotalAlert Scroll Medical Air Systems web application
Published: 2018-03-21T20:00:00.000Z
CVE-2018-7516 
A server-side request forgery vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could lead to proxied network scans.
Problem types: cwe_id: CWE-918
description: SERVER-SIDE REQUEST FORGERY (SSRF) CWE-918
Affected products: vendor: Geutebr&#195;&#188;ck
product: Geutebr&#195;&#188;ck G-Cam/EFD-2250 (part n&#194;&#176; 5.02024) firmware and Topline TopFD-2125 (part n&#194;&#176; 5.02820) firmware
Published: 2018-03-22T18:00:00.000Z
CVE-2018-7517 
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause an out of bounds vulnerability.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: ICS-CERT
product: Omron CX-Supervisor
Published: 2018-03-21T20:00:00.000Z
CVE-2018-7518 
In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, an attacker with network access to the integrated web server could retrieve default or user defined credentials stored and transmitted in an insecure manner.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
Affected products: vendor: ICS-CERT
product: BeaconMed&#195;&#166;s TotalAlert Scroll Medical Air Systems web application
Published: 2018-05-24T20:00:00.000Z
CVE-2018-7519 
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a heap-based buffer overflow.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: ICS-CERT
product: Omron CX-Supervisor
Published: 2018-03-21T20:00:00.000Z
CVE-2018-7520 
An improper access control vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras, which could allow a full configuration download, including passwords.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: Geutebr&#195;&#188;ck
product: Geutebr&#195;&#188;ck G-Cam/EFD-2250 (part n&#194;&#176; 5.02024) firmware and Topline TopFD-2125 (part n&#194;&#176; 5.02820) firmware
Published: 2018-03-22T18:00:00.000Z
CVE-2018-7521 
In Omron CX-Supervisor Versions 3.30 and prior, use after free vulnerabilities can be exploited when CX Supervisor parses a specially crafted project file.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: ICS-CERT
product: Omron CX-Supervisor
Published: 2018-03-21T20:00:00.000Z
CVE-2018-7522 
In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, when a system call is made, registers are stored to a fixed memory location. Modifying the data in this location could allow attackers to gain supervisor-level access and control system states.
Problem types: cwe_id: CWE-119
description: Improper Restriction Of Operations Within The Bounds Of A Memory Buffer CWE-119
Affected products: vendor: Schneider Electric
product: Triconex Tricon
Published: 2018-05-04T17:00:00.000Z