admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-08 05:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Synchronized data.

Browse Source
This commit is contained in:
CVE Team 2018-12-04 13:05:39 -05:00
parent 72186b53e7
commit d650d398ce
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
3 changed files with 89 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

166
2018/0xxx/CVE-2018-0468.json
View File

@ -1,86 +1,86 @@
{ {
"CVE_data_meta": { "CVE_data_meta" : {
"ASSIGNER": "psirt@cisco.com", "ASSIGNER" : "psirt@cisco.com",
"DATE_PUBLIC": "2018-12-04T16:00:00-0600", "DATE_PUBLIC" : "2018-12-04T16:00:00-0600",
"ID": "CVE-2018-0468", "ID" : "CVE-2018-0468",
"STATE": "PUBLIC", "STATE" : "PUBLIC",
"TITLE": "Cisco Energy Management Suite Default PostgreSQL Password Vulnerability" "TITLE" : "Cisco Energy Management Suite Default PostgreSQL Password Vulnerability"
}, },
"affects": { "affects" : {
"vendor": { "vendor" : {
"vendor_data": [ "vendor_data" : [
{ {
"product": { "product" : {
"product_data": [ "product_data" : [
{ {
"product_name": "Cisco Energy Management Suite ", "product_name" : "Cisco Energy Management Suite ",
"version": { "version" : {
"version_data": [ "version_data" : [
{ {
"version_value": "5.2" "version_value" : "5.2"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "Cisco" "vendor_name" : "Cisco"
} }
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability."
}
]
},
"exploit" : [
{
"lang" : "eng",
"value" : "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. "
}
],
"impact" : {
"cvss" : {
"baseScore" : "7.1",
"vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N ",
"version" : "3.0"
}
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "CWE-798"
}
] ]
} }
}, ]
"data_format": "MITRE", },
"data_type": "CVE", "references" : {
"data_version": "4.0", "reference_data" : [
"description": { {
"description_data": [ "name" : "20181204 Cisco Energy Management Suite Default PostgreSQL Password Vulnerability",
{ "refsource" : "CISCO",
"lang": "eng", "url" : "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181204-ems-sql-passwrd"
"value": "A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the installation of the PostgreSQL database with unchanged default access credentials. An attacker could exploit this vulnerability by logging in to the machine where CEMS is installed and establishing a local connection to the database. The fix for this vulnerability randomizes the database access password in new installations; however, the fix will not change the password for existing installations. Users are required to manually change the password, as documented in the Workarounds section of this advisory. There are workarounds that address this vulnerability. " }
} ]
] },
}, "source" : {
"exploit": [ "advisory" : "cisco-sa-20181204-ems-sql-passwrd",
{ "defect" : [
"lang": "eng", [
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. " "CSCvm09173"
} ]
], ],
"impact": { "discovery" : "INTERNAL"
"cvss": { }
"baseScore": "7.1",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N ",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20181204 Cisco Energy Management Suite Default PostgreSQL Password Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181204-ems-sql-passwrd"
}
]
},
"source": {
"advisory": "cisco-sa-20181204-ems-sql-passwrd",
"defect": [
[
"CSCvm09173"
]
],
"discovery": "INTERNAL"
}
} }

4
2018/7xxx/CVE-2018-7956.json
View File

@ -34,7 +34,7 @@
"description_data" : [ "description_data" : [
{ {
"lang" : "eng", "lang" : "eng",
"value" : "Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability that attackers can conduct bruteforce to the VIP App Web Services to get user information." "value" : "Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information."
} }
] ]
}, },
@ -53,6 +53,8 @@
"references" : { "references" : {
"reference_data" : [ "reference_data" : [
{ {
"name" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en",
"refsource" : "CONFIRM",
"url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en" "url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181129-01-huaweivip-en"
} }
] ]

4
2018/7xxx/CVE-2018-7987.json
View File

@ -34,7 +34,7 @@
"description_data" : [ "description_data" : [
{ {
"lang" : "eng", "lang" : "eng",
"value" : "There is an out-of-bounds write vulnerability on several smartphones. The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition." "value" : "There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition."
} }
] ]
}, },
@ -53,6 +53,8 @@
"references" : { "references" : {
"reference_data" : [ "reference_data" : [
{ {
"name" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en",
"refsource" : "CONFIRM",
"url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en" "url" : "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181128-02-smartphone-en"
} }
] ]