rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-14748 
Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS.
Problem types: description: Improper Authorization
Affected products: vendor: QNAP
product: QNAP QTS
Published: 2018-11-28T16:00:00.000Z
CVE-2018-14749 
Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS.
Problem types: description: Buffer Overflow
Affected products: vendor: QNAP
product: QNAP QTS
Published: 2018-11-28T16:00:00.000Z
CVE-2018-14767 
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-31T06:00:00.000Z
CVE-2018-14768 
Various VIVOTEK FD8*, FD9*, FE9*, IB8*, IB9*, IP9*, IZ9*, MS9*, SD9*, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-29T19:00:00.000Z
CVE-2018-14769 
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-14770 
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-14771 
VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via eventscript.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-05T21:00:00.000Z
CVE-2018-14772 
Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web application can execute arbitrary code on the underlying system via Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-16T22:00:00.000Z
CVE-2018-14773 
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T17:00:00.000Z
CVE-2018-14774 
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T17:00:00.000Z
CVE-2018-14775 
tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T06:00:00.000Z
CVE-2018-14776 
Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T06:00:00.000Z
CVE-2018-14777 
An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-01T19:00:00.000Z
CVE-2018-14779 
A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transfer_data()`: {% highlight c %} if(*out_len + recv_len - 2 > max_out) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", *out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using `memcpy()`, but no error handling happens to avoid the `memcpy()` in such cases. This code path can be triggered with malicious data coming from a smartcard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-15T18:00:00.000Z
CVE-2018-14780 
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-15T18:00:00.000Z
CVE-2018-14781 Medtronic MiniMed MMT-500/MMT-503 Remote Controllers Authentication Bypass by Capture-replay
Medtronic MiniMed MMT 

devices when paired with a remote controller and having the “easy bolus” and “remote bolus” options enabled (non-default), are vulnerable to a capture-replay attack. An attacker can capture the wireless transmissions between the remote controller and the pump and replay them to cause an insulin (bolus) delivery.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Medtronic
product: MMT- 508 - MiniMed pump
default_status: unaffected
vendor: Medtronic
product: MMT – 511 pump Paradigm
default_status: unaffected
vendor: Medtronic
product: MMT – 512 / MMT – 712 Paradigm x12
default_status: unaffected
vendor: Medtronic
product: MMT – 515 / MMT – 715 Paradigm x15
default_status: unaffected
vendor: Medtronic
product: MMT – 522 / MMT – 722 Paradigm REAL-TIME
default_status: unaffected
vendor: Medtronic
product: MMT – 522(K) / MMT – 722(K) Paradigm REAL-TIME
default_status: unaffected
vendor: Medtronic
product: MMT – 523 / MMT – 723 Paradigm Revel
default_status: unaffected
vendor: Medtronic
product: MMT – 523(K) / MMT – 723(K) Paradigm
default_status: unaffected
vendor: Medtronic
product: MMT – 554 / MMT – 754 MiniMed Veo
default_status: unaffected
vendor: Medtronic
product: MMT – 551 / MMT – 751 MiniMed 530G
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Billy Rios, Jesse Young, and Jonathan Butts of Whitescope LLC reported these vulnerabilities to CISA.
Published: 2018-08-13T22:00:00.000Z
CVE-2018-14782 
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles without authenticating the user.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: ICS-CERT
product: NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior.
Published: 2018-08-10T19:00:00.000Z
CVE-2018-14783 
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request forgery condition can occur, allowing an attacker to change passwords of the device remotely.
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY CWE-352
Affected products: vendor: ICS-CERT
product: NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior.
Published: 2018-08-10T19:00:00.000Z
CVE-2018-14784 
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable to several cross-site scripting attacks, allowing a remote attacker to run arbitrary code on the device.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: ICS-CERT
product: NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior.
Published: 2018-08-10T19:00:00.000Z
CVE-2018-14785 
NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the device is listed openly without authentication.
Problem types: cwe_id: CWE-548
description: INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-548
Affected products: vendor: ICS-CERT
product: NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior.
Published: 2018-08-10T19:00:00.000Z
CVE-2018-14786 
Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.
Problem types: cwe_id: CWE-287
description: Improper Authentication cwe-287
Affected products: vendor: Becton, Dickinson and Company
product: Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA
Published: 2018-08-23T19:00:00.000Z
CVE-2018-14787 
In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 2.x or prior and Xcelera Version 4.1 or prior), an attacker with escalated privileges could access folders which contain executables where authenticated users have write permissions, and could then execute arbitrary code with local administrative permissions.
Problem types: cwe_id: CWE-269
description: IMPROPER PRIVILEGE MANAGEMENT CWE-269
Affected products: vendor: Philips
product: IntelliSpace Cardiovascular (ISCV) products
Published: 2018-08-22T18:00:00.000Z
CVE-2018-14788 
Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs when parsing certain file types.
Problem types: cwe_id: CWE-120
description: BUFFER COPY WITHOUT CHECKING SIZE OF INPUT ('CLASSIC BUFFER OVERFLOW') CWE-120
Affected products: vendor: Fuji Electric
product: Alpha5 Smart Loader
Published: 2018-10-01T13:00:00.000Z
CVE-2018-14789 
In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search path or element vulnerability has been identified, which may allow an attacker to execute arbitrary code and escalate their level of privileges.
Problem types: cwe_id: CWE-428
description: UNQUOTED SEARCH PATH OR ELEMENT CWE-428
Affected products: vendor: Philips
product: IntelliSpace Cardiovascular (ISCV) products
Published: 2018-08-22T18:00:00.000Z
CVE-2018-14790 
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. A buffer over-read vulnerability may allow remote code execution on the device.
Problem types: cwe_id: CWE-126
description: BUFFER OVER-READ CWE-126
Affected products: vendor: Fuji Electric
product: FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace
Published: 2018-10-01T13:00:00.000Z
CVE-2018-14791 
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected products.
Problem types: cwe_id: CWE-269
description: IMPROPER PRIVILEGE MANAGEMENT CWE-269
Affected products: vendor: Emerson
product: DeltaV DCS
Published: 2018-08-23T19:00:00.000Z
CVE-2018-14792 
WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: WECON
product: PLC Editor
Published: 2018-09-19T15:00:00.000Z
CVE-2018-14793 
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: DeltaV
Published: 2018-08-21T14:00:00.000Z
CVE-2018-14794 
Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. The device does not perform a check on the length/size of a project file before copying the entire contents of the file to a heap-based buffer.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Fuji Electric
product: Alpha5 Smart Loader
Published: 2018-10-01T13:00:00.000Z
CVE-2018-14795 
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: ICS-CERT
product: DeltaV
Published: 2018-08-21T14:00:00.000Z
CVE-2018-14796 
Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denial of service attack.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: Tec4Data
product: SmartCooler
Published: 2018-09-20T19:00:00.000Z
CVE-2018-14797 
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: Emerson
product: DeltaV DCS
Published: 2018-08-23T19:00:00.000Z
CVE-2018-14798 
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The program does not properly parse FNC files that may allow for information disclosure.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: Fuji Electric
product: FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace
Published: 2018-10-01T13:00:00.000Z
CVE-2018-14799 
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: Philips
product: PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs
Published: 2018-08-22T18:00:00.000Z
CVE-2018-14800 
Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the boundary allocated to a stack object, which could allow execution of code under the context of the application.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Delta Electronics
product: ISPSoft
Published: 2018-10-03T13:00:00.000Z
CVE-2018-14801 
In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset existing passwords.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: Philips
product: PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs
Published: 2018-08-22T18:00:00.000Z
CVE-2018-14802 
Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. The program does not properly check user-supplied comments which may allow for arbitrary remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Fuji Electric
product: FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace
Published: 2018-10-01T13:00:00.000Z
CVE-2018-14803 
Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that could allow attackers to obtain extraneous product information, such as OS and software components, via the HTTP response header that is normally not available to the attacker, but might be useful information in an attack.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: Philips
product: e-Alert Unit (non-medical device)
Published: 2018-09-26T19:00:00.000Z
CVE-2018-14804 
Emerson AMS Device Manager v12.0 to v13.5.  A specially crafted script may be run that allows arbitrary remote code execution.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: Emerson
product: AMS Device Manager
Published: 2018-10-01T16:00:00.000Z
CVE-2018-14805 
ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are present. Both conditions are required to exploit this vulnerability.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: ICS-CERT
product: ABB eSOMS
Published: 2018-08-29T16:00:00.000Z
CVE-2018-14806 
Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: Advantech
product: Advantech WebAccess
Published: 2018-10-23T20:00:00.000Z
CVE-2018-14807 
A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Opto 22
product: PAC Control Basic and PAC Control Professional
Published: 2018-10-18T21:00:00.000Z
CVE-2018-14808 
Emerson AMS Device Manager v12.0 to v13.5.  Non-administrative users are able to change executable and library files on the affected products.
Problem types: cwe_id: CWE-269
description: IMPROPER PRIVILEGE MANAGEMENT CWE-269
Affected products: vendor: Emerson
product: AMS Device Manager
Published: 2018-10-01T16:00:00.000Z
CVE-2018-14809 
Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: Fuji Electric
product: V-Server
Published: 2018-09-26T20:00:00.000Z
CVE-2018-14810 
WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated user data to an unsafe method call, which may allow code to be executed in the context of an administrator.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: WECON
product: PI Studio HMI
vendor: WECON
product: PI Studio
Published: 2018-10-08T13:00:00.000Z
CVE-2018-14811 
Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: Fuji Electric
product: V-Server
Published: 2018-09-26T20:00:00.000Z
CVE-2018-14812 
An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1.0.2.0 and prior. Exploitation of this vulnerability could give an attacker access to the system with the same level of privilege as the application that utilizes the malicious DLL.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: Fuji Electric
product: Energy Savings Estimator
Published: 2018-10-24T21:00:00.000Z
CVE-2018-14813 
Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Fuji Electric
product: V-Server
Published: 2018-09-26T20:00:00.000Z
CVE-2018-14814 
WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object.
Problem types: cwe_id: CWE-125
description: Out-of-bounds read CWE-125
Affected products: vendor: WECON
product: WECON Technology PI Studio HMI
Published: 2019-03-27T19:50:08.000Z
CVE-2018-14815 
Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-26T20:00:00.000Z
CVE-2018-14816 
Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Advantech
product: Advantech WebAccess
Published: 2018-10-23T20:00:00.000Z
CVE-2018-14817 
Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-191
description: INTEGER UNDERFLOW CWE-191
Affected products: vendor: Fuji Electric
product: V-Server
Published: 2018-09-26T20:00:00.000Z
CVE-2018-14818 
WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: WECON
product: PI Studio HMI
vendor: WECON
product: PI Studio
Published: 2018-10-08T13:00:00.000Z