From d650d398ce2326f1a5d15f296e059f6970a2c2a9 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 4 Dec 2018 13:05:39 -0500 Subject: [PATCH] - Synchronized data. --- 2018/0xxx/CVE-2018-0468.json | 166 +++++++++++++++++------------------ 2018/7xxx/CVE-2018-7956.json | 4 +- 2018/7xxx/CVE-2018-7987.json | 4 +- 3 files changed, 89 insertions(+), 85 deletions(-) diff --git a/2018/0xxx/CVE-2018-0468.json b/2018/0xxx/CVE-2018-0468.json index bdf62e39a33..81905059787 100644 --- a/2018/0xxx/CVE-2018-0468.json +++ b/2018/0xxx/CVE-2018-0468.json @@ -1,86 +1,86 @@ { - "CVE_data_meta": { - "ASSIGNER": "psirt@cisco.com", - "DATE_PUBLIC": "2018-12-04T16:00:00-0600", - "ID": "CVE-2018-0468", - "STATE": "PUBLIC", - "TITLE": "Cisco Energy Management Suite Default PostgreSQL Password Vulnerability" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "Cisco Energy Management Suite ", - "version": { - "version_data": [ - { - "version_value": "5.2" - } - ] - } - } - ] - }, - "vendor_name": "Cisco" - } + "CVE_data_meta" : { + "ASSIGNER" : "psirt@cisco.com", + "DATE_PUBLIC" : "2018-12-04T16:00:00-0600", + "ID" : "CVE-2018-0468", + "STATE" : "PUBLIC", + "TITLE" : "Cisco Energy Management Suite Default PostgreSQL Password Vulnerability" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "Cisco Energy Management Suite ", + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + } + ] + } + } + ] + }, + "vendor_name" : "Cisco" + } + ] + } + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "data_version" : "4.0", + "description" : { + "description_data" : [ + { + "lang" : "eng", + "value" : "A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability." + } + ] + }, + "exploit" : [ + { + "lang" : "eng", + "value" : "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. " + } + ], + "impact" : { + "cvss" : { + "baseScore" : "7.1", + "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N ", + "version" : "3.0" + } + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "CWE-798" + } ] - } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability. " - } - ] - }, - "exploit": [ - { - "lang": "eng", - "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. " - } - ], - "impact": { - "cvss": { - "baseScore": "7.1", - "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N ", - "version": "3.0" - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-798" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "name": "20181204 Cisco Energy Management Suite Default PostgreSQL Password Vulnerability", - "refsource": "CISCO", - "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181204-ems-sql-passwrd" - } - ] - }, - "source": { - "advisory": "cisco-sa-20181204-ems-sql-passwrd", - "defect": [ - [ - "CSCvm09173" - ] - ], - "discovery": "INTERNAL" - } + } + ] + }, + "references" : { + "reference_data" : [ + { + "name" : "20181204 Cisco Energy Management Suite Default PostgreSQL Password Vulnerability", + "refsource" : "CISCO", + "url" : "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181204-ems-sql-passwrd" + } + ] + }, + "source" : { + "advisory" : "cisco-sa-20181204-ems-sql-passwrd", + "defect" : [ + [ + "CSCvm09173" + ] + ], + "discovery" : "INTERNAL" + } } diff --git a/2018/7xxx/CVE-2018-7956.json b/2018/7xxx/CVE-2018-7956.json index 59d53569b78..7e65fe597db 100644 --- a/2018/7xxx/CVE-2018-7956.json +++ b/2018/7xxx/CVE-2018-7956.json @@ -34,7 +34,7 @@ "description_data" : [ { "lang" : "eng", - "value" : "Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability that attackers can conduct bruteforce to the VIP App Web Services to get user information." + "value" : "Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information." } ] }, @@ -53,6 +53,8 @@ "references" : { "reference_data" : [ { + "name" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en", + "refsource" : "CONFIRM", "url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en" } ] diff --git a/2018/7xxx/CVE-2018-7987.json b/2018/7xxx/CVE-2018-7987.json index bc346f4223c..7b6c3e7eea3 100644 --- a/2018/7xxx/CVE-2018-7987.json +++ b/2018/7xxx/CVE-2018-7987.json @@ -34,7 +34,7 @@ "description_data" : [ { "lang" : "eng", - "value" : "There is an out-of-bounds write vulnerability on several smartphones. The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition." + "value" : "There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition." } ] }, @@ -53,6 +53,8 @@ "references" : { "reference_data" : [ { + "name" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en", + "refsource" : "CONFIRM", "url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en" } ]