diff --git a/2018/19xxx/CVE-2018-19391.json b/2018/19xxx/CVE-2018-19391.json index 5a98e599d8e..a59bc521970 100644 --- a/2018/19xxx/CVE-2018-19391.json +++ b/2018/19xxx/CVE-2018-19391.json @@ -2,7 +2,30 @@ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-19391", - "STATE" : "RESERVED" + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } }, "data_format" : "MITRE", "data_type" : "CVE", @@ -11,7 +34,33 @@ "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://cyberskr.com/blog/cobham-satcom-250-500.html", + "refsource" : "MISC", + "url" : "https://cyberskr.com/blog/cobham-satcom-250-500.html" + }, + { + "name" : "https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0", + "refsource" : "MISC", + "url" : "https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0" } ] } diff --git a/2018/19xxx/CVE-2018-19392.json b/2018/19xxx/CVE-2018-19392.json index 1ae08e47239..a835fab104f 100644 --- a/2018/19xxx/CVE-2018-19392.json +++ b/2018/19xxx/CVE-2018-19392.json @@ -2,7 +2,30 @@ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-19392", - "STATE" : "RESERVED" + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } }, "data_format" : "MITRE", "data_type" : "CVE", @@ -11,7 +34,33 @@ "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password (including the default \"admin\" account), without prior knowledge of their password. All that is required is knowledge of the username and attack vector (/index.lua?pageID=Administration usernameAdmChange, passwordAdmChange1, and passwordAdmChange2 fields)." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://cyberskr.com/blog/cobham-satcom-250-500.html", + "refsource" : "MISC", + "url" : "https://cyberskr.com/blog/cobham-satcom-250-500.html" + }, + { + "name" : "https://gist.github.com/CyberSKR/2dfd5dccb20a209ec4d35b2678bac0d4", + "refsource" : "MISC", + "url" : "https://gist.github.com/CyberSKR/2dfd5dccb20a209ec4d35b2678bac0d4" } ] } diff --git a/2018/19xxx/CVE-2018-19393.json b/2018/19xxx/CVE-2018-19393.json index 84d52a61393..0cd1854cfc7 100644 --- a/2018/19xxx/CVE-2018-19393.json +++ b/2018/19xxx/CVE-2018-19393.json @@ -2,7 +2,30 @@ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-19393", - "STATE" : "RESERVED" + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } }, "data_format" : "MITRE", "data_type" : "CVE", @@ -11,7 +34,33 @@ "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could be leveraged to achieve a Denial of Service (DoS) condition, where the device would require a factory reset to return to normal operation." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://cyberskr.com/blog/cobham-satcom-800-900.html", + "refsource" : "MISC", + "url" : "https://cyberskr.com/blog/cobham-satcom-800-900.html" + }, + { + "name" : "https://gist.github.com/CyberSKR/1ade6d887039465d635e27fcbcc817a3", + "refsource" : "MISC", + "url" : "https://gist.github.com/CyberSKR/1ade6d887039465d635e27fcbcc817a3" } ] } diff --git a/2018/19xxx/CVE-2018-19394.json b/2018/19xxx/CVE-2018-19394.json index 4b15e31ac91..1d4b2b7dbf4 100644 --- a/2018/19xxx/CVE-2018-19394.json +++ b/2018/19xxx/CVE-2018-19394.json @@ -2,7 +2,30 @@ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-19394", - "STATE" : "RESERVED" + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "n/a", + "version" : { + "version_data" : [ + { + "version_value" : "n/a" + } + ] + } + } + ] + }, + "vendor_name" : "n/a" + } + ] + } }, "data_format" : "MITRE", "data_type" : "CVE", @@ -11,7 +34,33 @@ "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name), and then restoring the malicious configuration file." + } + ] + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "n/a" + } + ] + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "https://cyberskr.com/blog/cobham-satcom-800-900.html", + "refsource" : "MISC", + "url" : "https://cyberskr.com/blog/cobham-satcom-800-900.html" + }, + { + "name" : "https://gist.github.com/CyberSKR/fe21b920c8933867ea262a325d37f03b", + "refsource" : "MISC", + "url" : "https://gist.github.com/CyberSKR/fe21b920c8933867ea262a325d37f03b" } ] }