From 76755a95806840cd70bf0a767c4f26f1bfe7195b Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 29 Aug 2018 18:05:19 -0400 Subject: [PATCH] - Synchronized data. --- 2018/16xxx/CVE-2018-16115.json | 48 +++++++++++++++++++++++- 2018/16xxx/CVE-2018-16131.json | 18 +++++++++ 2018/16xxx/CVE-2018-16132.json | 62 +++++++++++++++++++++++++++++++ 2018/16xxx/CVE-2018-16133.json | 67 ++++++++++++++++++++++++++++++++++ 2018/16xxx/CVE-2018-16134.json | 67 ++++++++++++++++++++++++++++++++++ 5 files changed, 260 insertions(+), 2 deletions(-) create mode 100644 2018/16xxx/CVE-2018-16131.json create mode 100644 2018/16xxx/CVE-2018-16132.json create mode 100644 2018/16xxx/CVE-2018-16133.json create mode 100644 2018/16xxx/CVE-2018-16134.json diff --git a/2018/16xxx/CVE-2018-16115.json b/2018/16xxx/CVE-2018-16115.json index 7e938804ac6..53b382c3db7 100644 --- a/2018/16xxx/CVE-2018-16115.json +++ b/2018/16xxx/CVE-2018-16115.json @@ -2,7 +2,30 @@ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-16115", - "STATE" : "RESERVED" + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } }, "data_format" : "MITRE", "data_type" : "CVE", @@ -11,7 +34,28 @@ "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html", + "refsource" : "MISC", + "url" : "https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html" } ] } diff --git a/2018/16xxx/CVE-2018-16131.json b/2018/16xxx/CVE-2018-16131.json new file mode 100644 index 00000000000..9e83480fbdc --- /dev/null +++ b/2018/16xxx/CVE-2018-16131.json @@ -0,0 +1,18 @@ +{ + "CVE_data_meta" : { + "ASSIGNER" : "cve@mitre.org", + "ID" : "CVE-2018-16131", + "STATE" : "RESERVED" + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} diff --git a/2018/16xxx/CVE-2018-16132.json b/2018/16xxx/CVE-2018-16132.json new file mode 100644 index 00000000000..8eaf05721b0 --- /dev/null +++ b/2018/16xxx/CVE-2018-16132.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta" : { + "ASSIGNER" : "cve@mitre.org", + "ID" : "CVE-2018-16132", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "http://seclists.org/bugtraq/2018/Aug/57", + "refsource" : "MISC", + "url" : "http://seclists.org/bugtraq/2018/Aug/57" + } + ] + } +} diff --git a/2018/16xxx/CVE-2018-16133.json b/2018/16xxx/CVE-2018-16133.json new file mode 100644 index 00000000000..cfe8f9937ec --- /dev/null +++ b/2018/16xxx/CVE-2018-16133.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta" : { + "ASSIGNER" : "cve@mitre.org", + "ID" : "CVE-2018-16133", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://emreovunc.com/blog/en/CyBroHttpServer-v.1.0.3-Directory-Traversal-3.png", + "refsource" : "MISC", + "url" : "https://emreovunc.com/blog/en/CyBroHttpServer-v.1.0.3-Directory-Traversal-3.png" + }, + { + "name" : "https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal", + "refsource" : "MISC", + "url" : "https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal" + } + ] + } +} diff --git a/2018/16xxx/CVE-2018-16134.json b/2018/16xxx/CVE-2018-16134.json new file mode 100644 index 00000000000..34bbc9451f0 --- /dev/null +++ b/2018/16xxx/CVE-2018-16134.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta" : { + "ASSIGNER" : "cve@mitre.org", + "ID" : "CVE-2018-16134", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://emreovunc.com/blog/en/CyBroHttpServer-v1.0.3-XSS.png", + "refsource" : "MISC", + "url" : "https://emreovunc.com/blog/en/CyBroHttpServer-v1.0.3-XSS.png" + }, + { + "name" : "https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Reflected-XSS", + "refsource" : "MISC", + "url" : "https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Reflected-XSS" + } + ] + } +}