rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-8770 
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.php, fixtures/Controller_fixt.php, fixtures/Controller_fixt2.php, fixtures/view_fixt2.php, libs/ipTest.php, or models/commonDbfix.php in tests/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-18T06:00:00.000Z
CVE-2018-8772 
Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T18:00:00.000Z
CVE-2018-8777 
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T22:00:00.000Z
CVE-2018-8778 
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T22:00:00.000Z
CVE-2018-8779 
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not checked for null characters. It may be connected to an unintended socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T22:00:00.000Z
CVE-2018-8780 
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-03T22:00:00.000Z
CVE-2018-8781 
The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux kernel version 3.4 and up to and including 4.15 has an integer-overflow vulnerability allowing local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Check Point Software Technologies Ltd.
product: Linux Kernel
Published: 2018-04-23T19:00:00.000Z
CVE-2018-8784 
FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T17:00:00.000Z
CVE-2018-8785 
FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T17:00:00.000Z
CVE-2018-8786 
FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T17:00:00.000Z
CVE-2018-8787 
FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T17:00:00.000Z
CVE-2018-8788 
FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T17:00:00.000Z
CVE-2018-8789 
FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of Service (segfault).
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: FreeRDP
Published: 2018-11-29T18:00:00.000Z
CVE-2018-8790 
Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Check Point Software Technologies Ltd.
product: ZoneAlarm
Published: 2019-03-01T16:00:00.000Z
CVE-2018-8791 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8792 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of Service (segfault).
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8793 
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8794 
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8795 
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8796 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of Service (segfault).
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8797 
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8798 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information leak.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8799 
rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial of Service (segfault).
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8800 
rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Check Point Software Technologies Ltd.
product: rdesktop
Published: 2019-02-05T20:00:00.000Z
CVE-2018-8801 
GitLab Community and Enterprise Editions version 8.3 up to 10.x before 10.3 are vulnerable to SSRF in the Services and webhooks component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-25T09:00:00.000Z
CVE-2018-8802 
SQL injection vulnerability in the management interface in ePortal  Manager allows remote attackers to execute arbitrary SQL commands  via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-26T21:00:00.000Z
CVE-2018-8804 
WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8805 
Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.php?r=default/column/index&col=guestbook request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8806 
In libming 0.4.8, there is a use-after-free in the decompileArithmeticOp function of decompile.c. Remote attackers could use this vulnerability to cause a denial-of-service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8807 
In libming 0.4.8, these is a use-after-free in the function decompileCALLFUNCTION of decompile.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8808 
In radare2 2.4.0, there is a heap-based buffer over-read in the r_asm_disassemble function of asm.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8809 
In radare2 2.4.0, there is a heap-based buffer over-read in the dalvik_op function of anal_dalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8810 
In radare2 2.4.0, there is a heap-based buffer over-read in the get_ivar_list_t function of mach0_classes.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted Mach-O file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T05:00:00.000Z
CVE-2018-8811 
Cross-site request forgery (CSRF) vulnerability in system/workplace/admin/accounts/user_role.jsp in OpenCMS 10.5.3 allows remote attackers to hijack the authentication of administrative users for requests that perform privilege escalation. Note: It is argued that OpenCMS allows only registered users to upload different kind of content artifacts (SVG, .doc, .docx). The uploaded content is stored in the CMS content repository "as is". In case of scripts inside an SVG, this may or may not be "malicious", there is no way of knowing if the uploaded SVG contains the script for a reason. To exploit the "issue", a user must have an account in the CMS as a content manager
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T07:00:00.000Z
CVE-2018-8813 
Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T15:00:00.000Z
CVE-2018-8814 
Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugin/[pluginname]/settings by crafting a malicious request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T15:00:00.000Z
CVE-2018-8815 
Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T07:00:00.000Z
CVE-2018-8817 
Wampserver before 3.1.3 has CSRF in add_vhost.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-25T19:00:00.000Z
CVE-2018-8819 
An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5. An unauthenticated attacker could enter malicious input to WebCTRL and a weakly configured XML parser will allow the application to disclose full file contents from the underlying web server OS via the "X-Wap-Profile" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-14T20:00:00.000Z
CVE-2018-8820 
An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xp_cmdshell. In some cases, the authentication requirement for the attack can be met by sending the default admin credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T20:00:00.000Z
CVE-2018-8821 
windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T07:00:00.000Z
CVE-2018-8822 
Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T00:00:00.000Z
CVE-2018-8823 
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-28T02:00:00.000Z
CVE-2018-8824 
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute a SQL Injection through function calls in the code parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T03:00:00.000Z
CVE-2018-8825 
Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-23T20:50:05.000Z
CVE-2018-8826 
ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; RT-AC52U B1, RT-AC1200 and RT-N600 routers with firmware before 3.0.0.4.380.10446; RT-AC55U and RT-AC55UHP routers with firmware before 3.0.0.4.382.50276; RT-AC86U and RT-AC2900 routers with firmware before 3.0.0.4.384.20648; and possibly other RT-series routers allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-20T20:00:00.000Z
CVE-2018-8827 
The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T23:00:00.000Z
CVE-2018-8828 
A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T20:00:00.000Z
CVE-2018-8831 
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-18T17:00:00.000Z
CVE-2018-8832 
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T21:00:00.000Z
CVE-2018-8833 
Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: ICS-CERT
product: Advantech WebAccess HMI Designer
Published: 2018-04-25T23:00:00.000Z
CVE-2018-8834 
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a heap-based buffer overflow.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: ICS-CERT
product: Omron CX-One
Published: 2018-04-17T19:00:00.000Z
CVE-2018-8835 
Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.
Problem types: cwe_id: CWE-415
description: DOUBLE FREE CWE-415
Affected products: vendor: ICS-CERT
product: Advantech WebAccess HMI Designer
Published: 2018-04-25T23:00:00.000Z
CVE-2018-8836 
Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during a TCP connection affecting the communications with commission and service tools. Specially crafted packets may also be sent to Port 2455/TCP/IP, used in Codesys management software, which may result in a denial-of-service condition of communications with commissioning and service tools.
Problem types: cwe_id: CWE-404
description: IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404
Affected products: vendor: WAGO
product: WAGO 750 Series
Published: 2018-04-03T13:00:00.000Z
CVE-2018-8837 
Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the intended buffer area and may allow remote code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: ICS-CERT
product: Advantech WebAccess HMI Designer
Published: 2018-04-25T23:00:00.000Z
CVE-2018-8838 
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
Problem types: description: Permissions, Privileges, and Access Controls
Affected products: vendor: ICS-CERT
product: Yokogawa CENTUM and Exaopc
Published: 2018-04-17T21:00:00.000Z
CVE-2018-8839 
Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value larger than is readable by PMSoft's fixed-length stack buffer. This can cause the buffer to be overwritten, which may allow arbitrary code execution or cause the application to crash. CVSS v3 base score: 7.1; CVSS vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. Delta Electronics recommends affected users update to at least PMSoft v2.11, which was made available as of March 22, 2018, or the latest available version.
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow CWE-121
Affected products: vendor: Delta Electronics
product: PMSoft
Published: 2018-04-30T15:00:00.000Z
CVE-2018-8840 
A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Schneider Electric InduSoft Web Studio and InTouch Machine Edition
Published: 2018-04-18T20:00:00.000Z
CVE-2018-8841 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an improper privilege management vulnerability may allow an authenticated user to modify files when read access should only be given to the user.
Problem types: cwe_id: CWE-269
description: IMPROPER PRIVILEGE MANAGEMENT CWE-269
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z