admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Synchronized data.

Browse Source
This commit is contained in:
CVE Team 2018-07-10 13:03:45 -04:00
parent a7957edf97
commit 4816315f08
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
27 changed files with 920 additions and 851 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
2015/9xxx/CVE-2015-9253.json
View File

@ -34,7 +34,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "An issue was discovered in PHP through 7.2.2. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility."
"value" : "An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility."
}
]
},
@ -66,6 +66,16 @@
"name" : "https://www.futureweb.at/security/CVE-2015-9253/",
"refsource" : "MISC",
"url" : "https://www.futureweb.at/security/CVE-2015-9253/"
},
{
"name" : "https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287",
"refsource" : "CONFIRM",
"url" : "https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287"
},
{
"name" : "https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8",
"refsource" : "CONFIRM",
"url" : "https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8"
}
]
}

118
2017/1xxx/CVE-2017-1729.json
View File

@ -1,56 +1,14 @@
{
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134909."
}
]
},
"data_format" : "MITRE",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Cross-Site Scripting",
"lang" : "eng"
}
]
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"AV" : "N",
"S" : "C",
"I" : "L",
"SCORE" : "5.400",
"AC" : "L",
"C" : "L",
"PR" : "L",
"A" : "N",
"UI" : "R"
},
"TM" : {
"RC" : "C",
"RL" : "O",
"E" : "H"
}
}
},
"CVE_data_meta" : {
"ID" : "CVE-2017-1729",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
"ID" : "CVE-2017-1729",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -88,27 +46,67 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"references" : {
"reference_data" : [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"refsource" : "CONFIRM",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/134909",
"title" : "X-Force Vulnerability Report",
"name" : "ibm-rqm-cve20171729-xss (134909)",
"refsource" : "XF"
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134909."
}
]
},
"data_version" : "4.0",
"data_type" : "CVE"
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "N",
"AC" : "L",
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"E" : "H",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Cross-Site Scripting"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20171729-xss(134909)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/134909"
}
]
}
}

80
2017/1xxx/CVE-2017-1738.json
View File

@ -1,47 +1,9 @@
{
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "L",
"UI" : "N",
"C" : "L",
"PR" : "L",
"SCORE" : "6.300",
"AC" : "L",
"S" : "U",
"I" : "L",
"AV" : "N"
},
"TM" : {
"RC" : "C",
"RL" : "O",
"E" : "U"
}
}
},
"CVE_data_meta" : {
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2017-1738",
"DATE_PUBLIC" : "2018-07-06T00:00:00"
},
"data_type" : "CVE",
"data_version" : "4.0",
"references" : {
"reference_data" : [
{
"refsource" : "CONFIRM",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"refsource" : "XF",
"title" : "X-Force Vulnerability Report",
"name" : "ibm-rqm-cve20171738-priv-escalation (134919)",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/134919"
}
]
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
@ -91,14 +53,36 @@
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 contains an undisclosed vulnerability that would allow an authenticated user to obtain elevated privileges. IBM X-Force ID: 134919."
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 contains an undisclosed vulnerability that would allow an authenticated user to obtain elevated privileges. IBM X-Force ID: 134919."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "L",
"AC" : "L",
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"S" : "U",
"SCORE" : "6.300",
"UI" : "N"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
@ -110,5 +94,19 @@
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20171738-priv-escalation(134919)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/134919"
}
]
}
}

80
2017/1xxx/CVE-2017-1791.json
View File

@ -1,9 +1,14 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2017-1791",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -41,52 +46,40 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"references" : {
"reference_data" : [
{
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)"
},
{
"title" : "X-Force Vulnerability Report",
"name" : "ibm-rqm-cve20171791-xss (137036)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137036"
}
]
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"CVE_data_meta" : {
"ID" : "CVE-2017-1791",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137036."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"AV" : "N",
"S" : "C",
"I" : "L",
"C" : "L",
"PR" : "L",
"SCORE" : "5.400",
"A" : "N",
"AC" : "L",
"UI" : "R",
"A" : "N"
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"RL" : "O",
"E" : "H",
"RC" : "C"
"RC" : "C",
"RL" : "O"
}
}
},
@ -95,20 +88,25 @@
{
"description" : [
{
"value" : "Cross-Site Scripting",
"lang" : "eng"
"lang" : "eng",
"value" : "Cross-Site Scripting"
}
]
}
]
},
"description" : {
"description_data" : [
"references" : {
"reference_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137036."
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20171791-xss(137036)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137036"
}
]
},
"data_format" : "MITRE"
}
}

72
2017/1xxx/CVE-2017-1792.json
View File

@ -1,9 +1,14 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2017-1792",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -41,55 +46,43 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"references" : {
"reference_data" : [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137037",
"refsource" : "XF",
"name" : "ibm-rqm-cve20171792-xss (137037)",
"title" : "X-Force Vulnerability Report"
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137037."
}
]
},
"data_type" : "CVE",
"data_version" : "4.0",
"impact" : {
"cvssv3" : {
"TM" : {
"RC" : "C",
"E" : "H",
"RL" : "O"
},
"BM" : {
"A" : "N",
"AC" : "L",
"AV" : "N",
"S" : "C",
"C" : "L",
"I" : "L",
"PR" : "L",
"C" : "L",
"AC" : "L",
"S" : "C",
"SCORE" : "5.400",
"A" : "N",
"UI" : "R"
},
"TM" : {
"E" : "H",
"RC" : "C",
"RL" : "O"
}
}
},
"CVE_data_meta" : {
"ID" : "CVE-2017-1792",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC"
},
"problemtype" : {
"problemtype_data" : [
{
@ -102,13 +95,18 @@
}
]
},
"description" : {
"description_data" : [
"references" : {
"reference_data" : [
{
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137037.",
"lang" : "eng"
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20171792-xss(137037)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137037"
}
]
},
"data_format" : "MITRE"
}
}

74
2017/1xxx/CVE-2017-1793.json
View File

@ -1,4 +1,10 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2017-1793",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
@ -6,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "Rational Quality Manager",
"version" : {
"version_data" : [
{
@ -36,8 +43,7 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Quality Manager"
}
}
]
},
@ -46,47 +52,34 @@
]
}
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137038",
"refsource" : "XF",
"title" : "X-Force Vulnerability Report",
"name" : "ibm-rqm-cve20171793-xss (137038)"
}
]
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"CVE_data_meta" : {
"ID" : "CVE-2017-1793",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC"
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137038."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"S" : "C",
"I" : "L",
"AV" : "N",
"A" : "N",
"UI" : "R",
"PR" : "L",
"C" : "L",
"AC" : "L",
"SCORE" : "5.400"
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"E" : "H",
"RC" : "C",
"RL" : "O",
"E" : "H"
"RL" : "O"
}
}
},
@ -102,13 +95,18 @@
}
]
},
"description" : {
"description_data" : [
"references" : {
"reference_data" : [
{
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137038.",
"lang" : "eng"
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20171793-xss(137038)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/137038"
}
]
},
"data_format" : "MITRE"
}
}

18
2018/13xxx/CVE-2018-13834.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13834",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13835.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13835",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13836.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13836",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13837.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13837",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13838.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13838",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13839.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13839",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13840.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13840",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13841.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13841",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2018/13xxx/CVE-2018-13842.json Normal file
View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-13842",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

13
2018/1xxx/CVE-2018-1331.json
View File

@ -44,7 +44,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "An attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user."
"value" : "In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user."
}
]
},
@ -63,10 +63,19 @@
"references" : {
"reference_data" : [
{
"url" : "http://storm.apache.org/2018/06/04/storm122-released.html"
"name" : "[oss-security] 20180710 CVE-2018-1331: Apache Storm remote code execution vulnerability",
"refsource" : "MLIST",
"url" : "http://www.openwall.com/lists/oss-security/2018/07/10/4"
},
{
"name" : "http://storm.apache.org/2018/06/04/storm113-released.html",
"refsource" : "CONFIRM",
"url" : "http://storm.apache.org/2018/06/04/storm113-released.html"
},
{
"name" : "http://storm.apache.org/2018/06/04/storm122-released.html",
"refsource" : "CONFIRM",
"url" : "http://storm.apache.org/2018/06/04/storm122-released.html"
}
]
}

84
2018/1xxx/CVE-2018-1396.json
View File

@ -1,22 +1,10 @@
{
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/138429",
"name" : "ibm-rqm-cve20181396-xss (138429)",
"title" : "X-Force Vulnerability Report",
"refsource" : "XF"
}
]
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1396",
"STATE" : "PUBLIC"
},
"data_version" : "4.0",
"data_type" : "CVE",
"affects" : {
"vendor" : {
"vendor_data" : [
@ -24,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "Rational Quality Manager",
"version" : {
"version_data" : [
{
@ -54,8 +43,7 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Quality Manager"
}
}
]
},
@ -64,50 +52,60 @@
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138429."
}
]
},
"impact" : {
"cvssv3" : {
"TM" : {
"RC" : "C",
"RL" : "O",
"E" : "H"
},
"BM" : {
"PR" : "L",
"C" : "L",
"AC" : "L",
"SCORE" : "5.400",
"UI" : "R",
"A" : "N",
"AC" : "L",
"AV" : "N",
"C" : "L",
"I" : "L",
"S" : "C"
"PR" : "L",
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"E" : "H",
"RC" : "C",
"RL" : "O"
}
}
},
"CVE_data_meta" : {
"ID" : "CVE-2018-1396",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC"
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Cross-Site Scripting",
"lang" : "eng"
"lang" : "eng",
"value" : "Cross-Site Scripting"
}
]
}
]
},
"data_format" : "MITRE",
"description" : {
"description_data" : [
"references" : {
"reference_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138429."
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20181396-xss(138429)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/138429"
}
]
}

132
2018/1xxx/CVE-2018-1423.json
View File

@ -1,68 +1,10 @@
{
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks agains the system. IBM X-Force ID: 139026."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Obtain Information",
"lang" : "eng"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599",
"title" : "IBM Security Bulletin 0716599 (Rational Collaborative Lifecycle Management) ",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599"
},
{
"refsource" : "XF",
"name" : "ibm-jazz-cve20181423-info-disc (139026)",
"title" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/139026"
}
]
},
"CVE_data_meta" : {
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1423",
"ASSIGNER" : "psirt@us.ibm.com"
"STATE" : "PUBLIC"
},
"impact" : {
"cvssv3" : {
"TM" : {
"RL" : "O",
"RC" : "C",
"E" : "U"
},
"BM" : {
"AV" : "N",
"UI" : "N",
"AC" : "L",
"C" : "L",
"SCORE" : "4.300",
"A" : "N",
"PR" : "L",
"I" : "N",
"S" : "U"
}
}
},
"data_type" : "CVE",
"affects" : {
"vendor" : {
"vendor_data" : [
@ -70,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "Rational Collaborative Lifecycle Management",
"version" : {
"version_data" : [
{
@ -100,8 +43,7 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Collaborative Lifecycle Management"
}
},
{
"product_name" : "Rational DOORS Next Generation",
@ -138,6 +80,7 @@
}
},
{
"product_name" : "Rational Rhapsody Design Manager",
"version" : {
"version_data" : [
{
@ -168,8 +111,7 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Rhapsody Design Manager"
}
},
{
"product_name" : "Rational Quality Manager",
@ -240,6 +182,7 @@
}
},
{
"product_name" : "Rational Software Architect Design Manager",
"version" : {
"version_data" : [
{
@ -258,8 +201,7 @@
"version_value" : "6.0.1"
}
]
},
"product_name" : "Rational Software Architect Design Manager"
}
},
{
"product_name" : "Rational Team Concert",
@ -302,5 +244,61 @@
]
}
},
"data_format" : "MITRE"
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks agains the system. IBM X-Force ID: 139026."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "N",
"AC" : "L",
"AV" : "N",
"C" : "L",
"I" : "N",
"PR" : "L",
"S" : "U",
"SCORE" : "4.300",
"UI" : "N"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Obtain Information"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599"
},
{
"name" : "ibm-jazz-cve20181423-info-disc(139026)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/139026"
}
]
}
}

82
2018/1xxx/CVE-2018-1458.json
View File

@ -1,27 +1,10 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1458"
"ID" : "CVE-2018-1458",
"STATE" : "PUBLIC"
},
"references" : {
"reference_data" : [
{
"name" : "https://www.ibm.com/support/docview.wss?uid=swg22016624",
"title" : "IBM Security Bulletin 2016624 (DB2 for Linux, UNIX and Windows)",
"url" : "https://www.ibm.com/support/docview.wss?uid=swg22016624",
"refsource" : "CONFIRM"
},
{
"title" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140209",
"name" : "ibm-db2-cve20181458-priv-escalation (140209) ",
"refsource" : "XF"
}
]
},
"data_format" : "MITRE",
"affects" : {
"vendor" : {
"vendor_data" : [
@ -29,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "DB2 for Linux, UNIX and Windows",
"version" : {
"version_data" : [
{
@ -44,8 +28,7 @@
"version_value" : "11.1"
}
]
},
"product_name" : "DB2 for Linux, UNIX and Windows"
}
}
]
},
@ -54,36 +37,37 @@
]
}
},
"impact" : {
"cvssv3" : {
"BM" : {
"AC" : "H",
"AV" : "L",
"UI" : "N",
"C" : "H",
"SCORE" : "7.400",
"PR" : "N",
"A" : "H",
"S" : "U",
"I" : "H"
},
"TM" : {
"RL" : "O",
"RC" : "C",
"E" : "U"
}
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209."
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "H",
"AC" : "H",
"AV" : "L",
"C" : "H",
"I" : "H",
"PR" : "N",
"S" : "U",
"SCORE" : "7.400",
"UI" : "N"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
@ -95,5 +79,19 @@
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "https://www.ibm.com/support/docview.wss?uid=swg22016624",
"refsource" : "CONFIRM",
"url" : "https://www.ibm.com/support/docview.wss?uid=swg22016624"
},
{
"name" : "ibm-db2-cve20181458-priv-escalation(140209) ",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140209"
}
]
}
}

84
2018/1xxx/CVE-2018-1487.json
View File

@ -1,25 +1,9 @@
{
"references" : {
"reference_data" : [
{
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22016505",
"title" : "IBM Security Bulletin 2016505 (DB2 for Linux, UNIX and Windows) ",
"name" : "http://www.ibm.com/support/docview.wss?uid=swg22016505"
},
{
"name" : "ibm-db2-cve20181487-priv-escalation (140972)",
"title" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140972",
"refsource" : "XF"
}
]
},
"CVE_data_meta" : {
"ID" : "CVE-2018-1487",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-09T00:00:00",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
"ID" : "CVE-2018-1487",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
@ -28,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "DB2 for Linux, UNIX and Windows",
"version" : {
"version_data" : [
{
@ -43,8 +28,7 @@
"version_value" : "11.1"
}
]
},
"product_name" : "DB2 for Linux, UNIX and Windows"
}
}
]
},
@ -53,37 +37,37 @@
]
}
},
"data_type" : "CVE",
"impact" : {
"cvssv3" : {
"BM" : {
"AV" : "L",
"UI" : "N",
"AC" : "L",
"C" : "H",
"SCORE" : "8.400",
"A" : "H",
"PR" : "N",
"I" : "H",
"S" : "U"
},
"TM" : {
"RL" : "O",
"RC" : "C",
"E" : "U"
}
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972."
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "H",
"AC" : "L",
"AV" : "L",
"C" : "H",
"I" : "H",
"PR" : "N",
"S" : "U",
"SCORE" : "8.400",
"UI" : "N"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
@ -95,5 +79,19 @@
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=swg22016505",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22016505"
},
{
"name" : "ibm-db2-cve20181487-priv-escalation(140972)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140972"
}
]
}
}

138
2018/1xxx/CVE-2018-1492.json
View File

@ -1,68 +1,9 @@
{
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977."
}
]
},
"data_version" : "4.0",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Gain Access",
"lang" : "eng"
}
]
}
]
},
"CVE_data_meta" : {
"ID" : "CVE-2018-1492",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
},
"references" : {
"reference_data" : [
{
"refsource" : "CONFIRM",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599 ",
"title" : "IBM Security Bulletin 0716599 (Rational Collaborative Lifecycle Management)",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140977",
"title" : "X-Force Vulnerability Report",
"name" : "ibm-jazz-cve20181492-gain-access (140977)",
"refsource" : "XF"
}
]
},
"data_format" : "MITRE",
"data_type" : "CVE",
"impact" : {
"cvssv3" : {
"TM" : {
"RL" : "O",
"RC" : "C",
"E" : "U"
},
"BM" : {
"S" : "U",
"I" : "L",
"PR" : "N",
"A" : "L",
"SCORE" : "4.300",
"AC" : "L",
"UI" : "N",
"AV" : "P",
"C" : "L"
}
}
"ID" : "CVE-2018-1492",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
@ -71,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "Rational Engineering Lifecycle Manager",
"version" : {
"version_data" : [
{
@ -101,10 +43,10 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Engineering Lifecycle Manager"
}
},
{
"product_name" : "Rational Software Architect Design Manager",
"version" : {
"version_data" : [
{
@ -123,8 +65,7 @@
"version_value" : "6.0.1"
}
]
},
"product_name" : "Rational Software Architect Design Manager"
}
},
{
"product_name" : "Rational Team Concert",
@ -195,6 +136,7 @@
}
},
{
"product_name" : "Rational DOORS Next Generation",
"version" : {
"version_data" : [
{
@ -225,10 +167,10 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational DOORS Next Generation"
}
},
{
"product_name" : "Rational Rhapsody Design Manager",
"version" : {
"version_data" : [
{
@ -259,8 +201,7 @@
"version_value" : "6.0.5"
}
]
},
"product_name" : "Rational Rhapsody Design Manager"
}
},
{
"product_name" : "Rational Quality Manager",
@ -302,5 +243,62 @@
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "L",
"AC" : "L",
"AV" : "P",
"C" : "L",
"I" : "L",
"PR" : "N",
"S" : "U",
"SCORE" : "4.300",
"UI" : "N"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Gain Access"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716599"
},
{
"name" : "ibm-jazz-cve20181492-gain-access(140977)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/140977"
}
]
}
}

124
2018/1xxx/CVE-2018-1523.json
View File

@ -1,74 +1,14 @@
{
"data_format" : "MITRE",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141804."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Cross-Site Scripting"
}
]
}
]
},
"impact" : {
"cvssv3" : {
"TM" : {
"E" : "U",
"RL" : "O",
"RC" : "C"
},
"BM" : {
"SCORE" : "5.400",
"AC" : "L",
"C" : "L",
"PR" : "L",
"UI" : "R",
"A" : "N",
"AV" : "N",
"I" : "L",
"S" : "C"
}
}
},
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1523",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
},
"data_type" : "CVE",
"data_version" : "4.0",
"references" : {
"reference_data" : [
{
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)"
},
{
"title" : "X-Force Vulnerability Report",
"name" : "ibm-rqm-cve20181523-xss (141804)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/141804"
}
]
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -106,9 +46,67 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141804."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"A" : "N",
"AC" : "L",
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Cross-Site Scripting"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20181523-xss(141804)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/141804"
}
]
}
}

66
2018/1xxx/CVE-2018-1549.json
View File

@ -1,4 +1,10 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1549",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
@ -46,50 +52,37 @@
]
}
},
"references" : {
"reference_data" : [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"refsource" : "CONFIRM",
"title" : "IBM Security Bulletin 0716607 (Rational Quality Manager)",
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/142658",
"refsource" : "XF",
"name" : "ibm-rqm-cve20181549-response-splitting (142658)",
"title" : "X-Force Vulnerability Report"
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 142658."
}
]
},
"data_type" : "CVE",
"data_version" : "4.0",
"impact" : {
"cvssv3" : {
"BM" : {
"I" : "L",
"S" : "C",
"AV" : "N",
"A" : "N",
"UI" : "R",
"AC" : "L",
"SCORE" : "5.400",
"AV" : "N",
"C" : "L",
"I" : "L",
"PR" : "L",
"C" : "L"
"S" : "C",
"SCORE" : "5.400",
"UI" : "R"
},
"TM" : {
"RL" : "O",
"E" : "U",
"RC" : "C"
"RC" : "C",
"RL" : "O"
}
}
},
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC",
"ID" : "CVE-2018-1549",
"DATE_PUBLIC" : "2018-07-06T00:00:00"
},
"problemtype" : {
"problemtype_data" : [
{
@ -102,13 +95,18 @@
}
]
},
"description" : {
"description_data" : [
"references" : {
"reference_data" : [
{
"lang" : "eng",
"value" : "IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 142658."
"name" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=ibm10716607"
},
{
"name" : "ibm-rqm-cve20181549-response-splitting(142658)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/142658"
}
]
},
"data_format" : "MITRE"
}
}

98
2018/1xxx/CVE-2018-1566.json
View File

@ -1,55 +1,18 @@
{
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023."
}
]
},
"data_version" : "4.0",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Gain Privileges",
"lang" : "eng"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=swg22016182 ",
"title" : "IBM Security Bulletin 2016182 (DB2 for Linux, UNIX and Windows)",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22016182",
"refsource" : "CONFIRM"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/143023",
"title" : "X-Force Vulnerability Report",
"name" : "ibm-db2-cve20181566-format-string (143023)",
"refsource" : "XF"
}
]
},
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-07-06T00:00:00",
"ID" : "CVE-2018-1566",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
"product_name" : "DB2 for Linux, UNIX and Windows",
"version" : {
"version_data" : [
{
@ -65,35 +28,70 @@
"version_value" : "11.1"
}
]
},
"product_name" : "DB2 for Linux, UNIX and Windows"
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023."
}
]
},
"impact" : {
"cvssv3" : {
"BM" : {
"SCORE" : "8.400",
"A" : "H",
"AC" : "L",
"AV" : "L",
"UI" : "N",
"C" : "H",
"I" : "H",
"PR" : "N",
"S" : "U",
"A" : "H",
"PR" : "N"
"SCORE" : "8.400",
"UI" : "N"
},
"TM" : {
"RC" : "C",
"E" : "U",
"RC" : "C",
"RL" : "O"
}
}
},
"data_type" : "CVE",
"data_format" : "MITRE"
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Gain Privileges"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://www.ibm.com/support/docview.wss?uid=swg22016182",
"refsource" : "CONFIRM",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22016182"
},
{
"name" : "ibm-db2-cve20181566-format-string(143023)",
"refsource" : "XF",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/143023"
}
]
}
}

254
2018/5xxx/CVE-2018-5553.json
View File

@ -1,133 +1,135 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2018-5553",
"ASSIGNER": "cve@rapid7.com",
"DATE_PUBLIC": "2018-06-12T10:00:00.000Z",
"TITLE": "Crestron DGE-100 Console Command Injection (FIXED)",
"AKA": "",
"STATE": "PUBLIC"
},
"source": {
"defect": [],
"advisory": "R7-2018-15",
"discovery": "EXTERNAL"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Crestron",
"product": {
"product_data": [
{
"product_name": "DGE-100",
"version": {
"version_data": [
{
"version_name": "",
"affected": "<=",
"version_value": "1.3384.00049.001",
"platform": ""
}
"CVE_data_meta" : {
"AKA" : "",
"ASSIGNER" : "cve@rapid7.com",
"DATE_PUBLIC" : "2018-06-12T10:00:00.000Z",
"ID" : "CVE-2018-5553",
"STATE" : "PUBLIC",
"TITLE" : "Crestron DGE-100 Console Command Injection (FIXED)"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "DGE-100",
"version" : {
"version_data" : [
{
"affected" : "<=",
"platform" : "",
"version_name" : "",
"version_value" : "1.3384.00049.001"
}
]
}
},
{
"product_name" : "TS-1542-C",
"version" : {
"version_data" : [
{
"affected" : "<=",
"platform" : "",
"version_name" : "",
"version_value" : "1.3384.00049.001"
}
]
}
},
{
"product_name" : "DM-DGE-200-C",
"version" : {
"version_data" : [
{
"affected" : "<=",
"platform" : "",
"version_name" : "",
"version_value" : "1.3384.00049.001"
}
]
}
}
]
}
},
{
"product_name": "TS-1542-C",
"version": {
"version_data": [
{
"version_name": "",
"affected": "<=",
"version_value": "1.3384.00049.001",
"platform": ""
}
]
}
},
{
"product_name": "DM-DGE-200-C",
"version": {
"version_data": [
{
"version_name": "",
"affected": "<=",
"version_value": "1.3384.00049.001",
"platform": ""
}
]
}
}
]
}
}
},
"vendor_name" : "Crestron"
}
]
}
},
"configuration" : [],
"credit" : [
{
"lang" : "eng",
"value" : "This issue was discovered by Rapid7 researchers Cale Black and Jordan Larose. It is being disclosed in accordance Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."
}
],
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access."
}
]
}
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access."
},
"exploit" : [],
"impact" : {
"cvss" : {
"attackComplexity" : "LOW",
"attackVector" : "NETWORK",
"availabilityImpact" : "HIGH",
"baseScore" : 9.8,
"baseSeverity" : "CRITICAL",
"confidentialityImpact" : "HIGH",
"integrityImpact" : "HIGH",
"privilegesRequired" : "NONE",
"scope" : "UNCHANGED",
"userInteraction" : "NONE",
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version" : "3.0"
}
]
},
"problemtype": {
"problemtype_data": [
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : " CWE-78 (Improper Neutralization of Special Elements used in an OS Command)"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed/",
"refsource" : "MISC",
"url" : "https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed/"
},
{
"name" : "https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE%C2%AD-2018%C2%AD-5553",
"refsource" : "CONFIRM",
"url" : "https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE%C2%AD-2018%C2%AD-5553"
}
]
},
"solution" : [
{
"description": [
{
"lang": "eng",
"value": " CWE-78 (Improper Neutralization of Special Elements used in an OS Command)"
}
]
"lang" : "eng",
"value" : "Users should update affected devices to the latest firmware version (1.3384.00059.001 or higher) available from Crestron's product pages."
}
]
},
"references": {
"reference_data": [
{
"url": "https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed/",
"name": "Rapid7 disclosure blog post"
},
{
"url": "https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE%C2%AD-2018%C2%AD-5553",
"name": "Crestron security bulletin"
}
]
},
"configuration": [],
"impact": {
"cvss": {
"version": "3.0",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
},
"exploit": [],
"work_around": [],
"solution": [
{
"lang": "eng",
"value": "Users should update affected devices to the latest firmware version (1.3384.00059.001 or higher) available from Crestron's product pages."
}
],
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Rapid7 researchers Cale Black and Jordan Larose. It is being disclosed in accordance Rapid7's vulnerability disclosure policy (https://www.rapid7.com/disclosure/)."
}
]
],
"source" : {
"advisory" : "R7-2018-15",
"defect" : [],
"discovery" : "EXTERNAL"
},
"work_around" : []
}

48
2018/6xxx/CVE-2018-6620.json
View File

@ -2,30 +2,7 @@
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-6620",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a",
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
"STATE" : "REJECT"
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -34,28 +11,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "Odoo does not require authentication to be configured for a Backup Database action."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "n/a"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "http://asdedc.bid/odoo.html",
"refsource" : "MISC",
"url" : "http://asdedc.bid/odoo.html"
"value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}

50
2018/7xxx/CVE-2018-7775.json
View File

@ -1,32 +1,9 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cybersecurity@schneider-electric.com",
"ASSIGNER" : "cve@mitre.org",
"DATE_PUBLIC" : "2018-04-05T00:00:00",
"ID" : "CVE-2018-7775",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "U.Motion",
"version" : {
"version_data" : [
{
"version_value" : "U.motion Builder Software, all versions prior to v1.3.4"
}
]
}
}
]
},
"vendor_name" : "Schneider Electric SE"
}
]
}
"STATE" : "REJECT"
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -35,28 +12,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Error Information Disclosure"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/",
"refsource" : "CONFIRM",
"url" : "https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/"
"value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-9960. Reason: This candidate is a duplicate of CVE-2017-9960. Notes: All CVE users should reference CVE-2017-9960 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
}
]
}