rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-10622 Medtronic MyCareLink 24950 Patient Monitor Cleartext Storage in a File or on Disk
Medtronic MyCareLink Patient Monitor uses per-product credentials that 
are stored in a recoverable format. An attacker can use these 
credentials to modify encrypted drive data.
Problem types: cwe_id: CWE-313
description: CWE-313
Affected products: vendor: Medtronic
product: 24950 MyCareLink Monitor
default_status: unaffected
vendor: Medtronic
product: 24952 MyCareLink Monitor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
Published: 2018-08-10T18:00:00.000Z
CVE-2018-10623 
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote code execution, alter the intended control flow, allow reading of sensitive information, or cause the application to crash.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: Delta Electronics
product: Delta Industrial Automation DOPSoft
Published: 2018-06-18T19:00:00.000Z
CVE-2018-10624 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information
In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Johnson Controls
product: Metasys System
default_status: unaffected
vendor: Johnson Controls
product: BCPro (BCM)
default_status: unaffected
Credits: lang: en
value: Dan Regalado of Zingbox reported this vulnerability to CISA.
Published: 2018-08-01T21:00:00.000Z
CVE-2018-10626 Medtronic MyCareLink 24950 Patient Monitor Insufficient Verification of Data Authenticity
Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An 
attacker who obtains per-product credentials from the monitor and paired
 implantable cardiac device information can potentially upload invalid 
data to the Medtronic CareLink network.
Problem types: cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: Medtronic
product: 24950 MyCareLink Monitor
default_status: unaffected
vendor: Medtronic
product: 24952 MyCareLink Monitor
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Credits: lang: en
value: Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
Published: 2018-08-10T18:00:00.000Z
CVE-2018-10627 
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to retrieve and change sensitive configuration items such as the usernames and passwords for the Web and FTP servers. This vulnerability does not affect the i.LON 600 product.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: Echelon
product: SmartServer 1
vendor: Echelon
product: SmartServer 2
vendor: Echelon
product: i.LON 100
vendor: Echelon
product: i.LON 600
Published: 2018-07-24T17:00:00.000Z
CVE-2018-10628 
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: AVEVA Software, LLC.
product: InTouch
Published: 2018-07-24T18:00:00.000Z
CVE-2018-10630 
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open.
Problem types: cwe_id: CWE-284
description: Improper Access Control CWE-284
Affected products: vendor: ICS-CERT
product: Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001
Published: 2018-08-10T19:00:00.000Z
CVE-2018-10631 Medtronic N'Vision Clinician Programmer Protection Mechanism Failure
The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical access to an 8870 Application Card and sufficient technical capability can modify the contents of this card, including the binary executables. If modified to bypass protection mechanisms, this malicious code will be run when the card is inserted into an 8840 Clinician Programmer.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: Medtronic
product: 8840 N’Vision Clinician Programmer
default_status: unaffected
vendor: Medtronic
product: 8870 N’Vision removable Application Card
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Billy Rios and Jonathan Butts of Whitescope LLC reported this vulnerability
Published: 2018-07-13T19:00:00.000Z
CVE-2018-10632 
In Moxa NPort 5210, 5230, and 5232 versions 2.9 build 17030709 and prior, the amount of resources requested by a malicious actor are not restricted, allowing for a denial-of-service condition.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-400
Affected products: vendor: Moxa
product: NPort 5210, 5230, and 5232
Published: 2018-07-24T17:00:00.000Z
CVE-2018-10633 
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: Universal Robots
product: Universal Robots Robot Controller version CB 3.1, SW Version 3.4.5-100
Published: 2018-07-11T17:00:00.000Z
CVE-2018-10634 Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Cleartext Transmission of Sensitive Information
Communications between Medtronic MiniMed MMT pumps and wireless accessories are transmitted in cleartext. A sufficiently skilled attacker could capture these transmissions and extract sensitive information, such as device serial numbers.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Medtronic
product: MMT- 508 - MiniMed pump
default_status: unaffected
vendor: Medtronic
product: MMT – 511 pump Paradigm
default_status: unaffected
vendor: Medtronic
product: MMT – 512 / MMT – 712 Paradigm x12
default_status: unaffected
vendor: Medtronic
product: MMT – 515 / MMT – 715 Paradigm x15
default_status: unaffected
vendor: Medtronic
product: MMT – 522 / MMT – 722 Paradigm REAL-TIME
default_status: unaffected
vendor: Medtronic
product: MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME
default_status: unaffected
vendor: Medtronic
product: MMT – 523 / MMT – 723 Paradigm Revel
default_status: unaffected
vendor: Medtronic
product: MMT – 523(K) / MMT – 723(K) Paradigm
default_status: unaffected
vendor: Medtronic
product: MMT – 554 / MMT – 754 MiniMed Veo
default_status: unaffected
vendor: Medtronic
product: MMT – 551 / MMT – 751 MiniMed 530G
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
Published: 2018-08-13T22:00:00.000Z
CVE-2018-10635 
In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: Universal Robots
product: Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100
Published: 2018-07-11T17:00:00.000Z
CVE-2018-10636 
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking user input validation before copying data from project files onto the stack. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: CNCSoft with ScreenEditor
Published: 2018-08-13T22:00:00.000Z
CVE-2018-10637 
A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite 4.0.3.0 and prior.
Problem types: cwe_id: CWE-120
description: BUFFER COPY WITHOUT CHECKING SIZE OF INPUT ('CLASSIC BUFFER OVERFLOW') CWE-120
Affected products: vendor: Fuji Electric
product: V-Server Lite
Published: 2018-09-13T20:00:00.000Z
CVE-2018-10641 
D-Link DIR-601 A1 1.02NA devices do not require the old password for a password change, which occurs in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-04T03:00:00.000Z
CVE-2018-10642 
Command injection vulnerability in Combodo iTop 2.4.1 allows remote authenticated administrators to execute arbitrary commands by changing the platform configuration, because web/env-production/itop-config/config.php contains a function called TestConfig() that calls the vulnerable function eval().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T07:00:00.000Z
CVE-2018-10645 
Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. The "SetProperty" method allows an attacker to configure the "AdditionalOpenVpnParameters" property and control the OpenVPN command line. Using the OpenVPN "plugin" parameter, an attacker may specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user. This attack may be conducted using "VyprVPN Free" account credentials and the VyprVPN Desktop Client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T07:00:00.000Z
CVE-2018-10646 
CyberGhost 6.5.0.3180 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "CG6Service" service. This service establishes a NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "ConnectToVpnServer" method accepts a "connectionParams" argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T07:00:00.000Z
CVE-2018-10647 
SaferVPN 4.2.5 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "SaferVPN.Service" service. The "SaferVPN.Service" service executes "openvpn.exe" using OpenVPN config files located within the current user's %LOCALAPPDATA%\SaferVPN\OvpnConfig directory. An authenticated attacker may modify these configuration files to specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T07:00:00.000Z
CVE-2018-10648 
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10649 
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10650 
There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10651 
There are Open Redirect Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10652 
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10653 
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10654 
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-23T17:00:00.000Z
CVE-2018-10655 
DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-10T14:00:00.000Z
CVE-2018-10657 
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T16:00:00.000Z
CVE-2018-10658 
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code inside libdbus-send.so shared object or similar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10659 
There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by sending a crafted command which will result in a code path that calls the UND undefined ARM instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10660 
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10661 
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10662 
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10663 
An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10664 
An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-26T18:00:00.000Z
CVE-2018-10665 
ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T17:00:00.000Z
CVE-2018-10666 
The Owned smart contract implementation for Aurora IDEX Membership (IDXM), an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. A new owner can subsequently modify variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-03T04:00:00.000Z
CVE-2018-10675 
The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T18:00:00.000Z
CVE-2018-10676 
CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Vision DVR devices allow remote attackers to download a file and obtain sensitive credential information via a direct request for the download.rsp URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T18:00:00.000Z
CVE-2018-10677 
The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T19:00:00.000Z
CVE-2018-10678 
MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-13T20:00:00.000Z
CVE-2018-10680 
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T19:00:00.000Z
CVE-2018-10682 
An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-09T08:00:00.000Z
CVE-2018-10683 
An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-09T08:00:00.000Z
CVE-2018-10685 
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the lzma_decompress_buf function of stream.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T22:00:00.000Z
CVE-2018-10686 
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-06T05:00:00.000Z
CVE-2018-10689 
blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-03T07:00:00.000Z
CVE-2018-10690 
An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T19:17:33.000Z
CVE-2018-10691 
An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T19:19:28.000Z
CVE-2018-10692 
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T19:21:02.000Z
CVE-2018-10693 
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-07T19:22:36.000Z