DuyTa/cve-kgrag-db huggingface dataset:
CVE-2019-14082
Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9207C, MDM9607, QCN7605, SM8150
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v2.0 Score: 9.4 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:N/A:C
Affected Products: mdm9607, ipq8074_firmware, mdm9607_firmware, mdm9206_firmware, sm8150_firmware
Related CWEs: CWE-20, CWE-125
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin, https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin
CWE: CWE-20, CWE-125
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2019-5159
An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of executing a firmware update, potentially resulting in code execution. An attacker can create a malicious firmware update package file using any zip utility. The user must initiate a firmware update through e!COCKPIT and choose the malicious wup file using the file browser to trigger the vulnerability.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: e\!cockpit
Related CWEs: CWE-668
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0952, https://talosintelligence.com/vulnerability_reports/TALOS-2019-0952
CWE: CWE-668
CVE-2019-17421
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: manageengine_firewall_analyzer, manageengine_opmanager
Related CWEs: CWE-276
Related CAPECs: CAPEC-127, CAPEC-1, CAPEC-81
MITRE ATT&CK Techniques: T1083, T1574.010
MITRE ATT&CK Tactics: T1574
References: https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html, https://twitter.com/va_start, https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html
CWE: CWE-276
MITRE ATT&CK techniques: T1083, T1574.010
MITRE ATT&CK tactics: T1574
CVE-2019-16516
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: control
Related CWEs: CWE-203
Related CAPECs: CAPEC-189
References: http://packetstormsecurity.com/files/165432/ConnectWise-Control-19.2.24707-Username-Enumeration.html, https://blog.huntresslabs.com/validating-the-bishop-fox-findings-in-connectwise-control-9155eec36a34, https://know.bishopfox.com/advisories
CWE: CWE-203
CVE-2019-10444
Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: bumblebee_hp_alm
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481, https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1481
CWE: CWE-295
CVE-2019-15502
The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode characters U+2068 (FIRST STRONG ISOLATE) and U+2067 (RIGHT-TO-LEFT ISOLATE).
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: teamspeak
References: https://forum.teamspeak.com/threads/141134-Release-TeamSpeak-Client-3-3-2, https://r4p3.net/threads/teamkilled-new-teamspeak-crash.8144/, https://www.youtube.com/watch?v=PlVbPIs75D4
CVE-2019-14226
OX App Suite through 7.10.2 has Insecure Permissions.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: open-xchange_appsuite
Related CWEs: CWE-281
References: http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html, https://seclists.org/fulldisclosure/2019/Oct/25, http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html
CWE: CWE-281
CVE-2019-25595
jetAudio 8.1.7.20702 Basic contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string through the URL input handler. Attackers can trigger the crash by pasting a buffer of 5000 characters into the Open URL dialog, causing the application to terminate abnormally.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Related CWEs: CWE-469
References: http://www.jetaudio.com/, http://www.jetaudio.com/download/, https://www.exploit-db.com/exploits/46810
CWE: CWE-469
CVE-2019-10522
While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sd_712_firmware, sd_415_firmware, sd_675, sd_210_firmware, sd_429
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://source.android.com/security/bulletin/, https://source.android.com/security/bulletin/
CWE: CWE-120
CVE-2019-3005
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.34 and prior to 6.0.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
CVSS v3.1 Score: 6.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: vm_virtualbox
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html, https://security.gentoo.org/glsa/202004-02, https://security.gentoo.org/glsa/202101-09
CVE-2019-15167
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products: tcpdump
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://github.com/the-tcpdump-group/tcpdump/commit/a152aebfd1114376ba266ed30416be596ef9d806, https://github.com/the-tcpdump-group/tcpdump/commit/a152aebfd1114376ba266ed30416be596ef9d806
CWE: CWE-125
CVE-2019-13170
Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: phaser_3320_firmware, phaser_3320
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://security.business.xerox.com/, https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/, https://security.business.xerox.com/
CWE: CWE-352
CVE-2019-0090
Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: server_platform_services, converged_security_and_management_engine
References: https://support.f5.com/csp/article/K59145983, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html, https://support.f5.com/csp/article/K59145983
CVE-2019-0899
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, windows_server_2016, windows_7, windows_rt_8.1
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0899, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0899
CVE-2019-11684
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: video_management_system, divar_ip_5000, divar_ip_5000_firmware, video_recording_manager
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: https://psirt.bosch.com/security-advisories/bosch-sa-804652.html, https://psirt.bosch.com/security-advisories/bosch-sa-804652.html
CWE: CWE-306
CVE-2019-15955
An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: total.js_cms
Related CWEs: CWE-327, CWE-330
Related CAPECs: CAPEC-614, CAPEC-97, CAPEC-459
MITRE ATT&CK Techniques: T1553.002, T1110, T1552.004
MITRE ATT&CK Tactics: T1553, T1036, T1552
References: https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf, https://seclists.org/fulldisclosure/2019/Sep/3, https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
CWE: CWE-327, CWE-330
MITRE ATT&CK techniques: T1553.002, T1110, T1552.004, T1036.001
MITRE ATT&CK tactics: T1553, T1036, T1552
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: halo
Related CWEs: CWE-918
Related CAPECs: CAPEC-664
References: https://github.com/halo-dev/halo/compare/v1.1.3-beta.2...v1.2.0-beta.1, https://github.com/halo-dev/halo/issues/419, https://github.com/halo-dev/halo/issues/440
CWE: CWE-918
CVE-2019-12941
AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: 4g//lte, 4g//lte_firmware, wi-fi//nb, wi-fi//nb_firmware
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: http://www.diva-portal.org/smash/get/diva2:1334244/FULLTEXT01.pdf, https://www.kth.se/nse/research/software-systems-architecture-and-security/, https://www.kth.se/polopoly_fs/1.931922.1571071632%21/Burdzovic_Matsson_dongle_v2.pdf
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2019-20799
In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: cherokee
Related CWEs: CWE-787
References: https://github.com/cherokee/webserver/issues/1221, https://github.com/cherokee/webserver/issues/1222, https://github.com/cherokee/webserver/issues/1225
CWE: CWE-787
CVE-2019-1259
A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1261.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: sharepoint_foundation
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1259, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1259
CWE: CWE-352
CVE-2019-10606
Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, QCS605, SDX24
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: qcs605_firmware, mdm9607, msm8909w_firmware, msm8917_firmware, msm8917
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin, https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CWE: CWE-120
CVE-2019-9300
In libAACdec, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112661610
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: android
Related CWEs: CWE-787, CWE-190
Related CAPECs: CAPEC-92
References: https://source.android.com/security/bulletin/android-10, https://source.android.com/security/bulletin/android-10
CWE: CWE-787, CWE-190
CVE-2019-5805
Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: leap, debian_linux, chrome, fedora, backports
Related CWEs: CWE-787, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html, https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html, https://crbug.com/913320
CWE: CWE-787, CWE-416
CVE-2019-5132
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library. A specially crafted GEM file can cause an out-of-bounds write, resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: imagegear
Related CWEs: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0921, https://talosintelligence.com/vulnerability_reports/TALOS-2019-0921
CWE: CWE-787
CVE-2019-14837
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Affected Products: single_sign-on, keycloak
Related CWEs: CWE-798, CWE-547
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837, https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f, https://issues.jboss.org/browse/KEYCLOAK-10780
CWE: CWE-798, CWE-547
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2019-4533
IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: linux, resilient_security_orchestration_automation_and_response
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165589, https://www.ibm.com/support/pages/node/6323645, https://exchange.xforce.ibmcloud.com/vulnerabilities/165589
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2019-5149
The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web server and makes use of the FastCGI module, which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However, the default configuration of this module appears to limit the number of concurrent php-cgi processes to two, which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13), and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: pfc100, pfc200, pfc100_firmware, pfc200_firmware
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0939, https://talosintelligence.com/vulnerability_reports/TALOS-2019-0939
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2019-3922
The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a remote, unauthenticated attacker to /GponForm/fsetup_Form. An attacker can leverage this vulnerability to potentially execute arbitrary code.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: i-240w-q_gpon_ont_firmware, i-240w-q_gpon_ont
Related CWEs: CWE-121, CWE-787
References: https://www.tenable.com/security/research/tra-2019-09, https://www.tenable.com/security/research/tra-2019-09
CWE: CWE-121, CWE-787
CVE-2019-16675
An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: config\+, pc_worx, pc_worx_express
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://cert.vde.com/en-us/advisories, https://www.us-cert.gov/ics/advisories/icsa-19-302-01, https://www.zerodayinitiative.com/advisories/ZDI-19-922/
CWE: CWE-125
CVE-2019-10601
Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MSM8996AU, Nicobar, QCA6574AU, QCN7605, QCS405, SDM630, SDM636, SDM660, SDM845, SM6150, SM7150, SM8150
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sdm636, sdm660, sm7150, sm6150_firmware, sm8150
Related CWEs: CWE-129
Related CAPECs: CAPEC-100
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin, https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CWE: CWE-129
CVE-2019-3630
Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: enterprise_security_manager
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10284, https://kc.mcafee.com/corporate/index?page=content&id=SB10284
CWE: CWE-78
CVE-2019-25351
Centova Cast 3.2.11 contains a file download vulnerability that allows authenticated attackers to retrieve arbitrary system files through the server.copyfile API endpoint. Attackers can exploit the vulnerability by supplying crafted parameters to download sensitive files like /etc/passwd using curl and wget requests.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://centova.com, https://www.exploit-db.com/exploits/47669, https://www.vulncheck.com/advisories/centova-cast-arbitrary-file-download
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2019-3486
Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1
CVSS v3.0 Score: 4.6 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: arcsight_management_center
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://community.microfocus.com/t5/ArcSight-Management-Center-ArcMC/ArcSight-Management-Center-2-91-Release-Notes/ta-p/1790266?attachment-id=74671, https://community.microfocus.com/t5/ArcSight-Management-Center-ArcMC/ArcSight-Management-Center-2-91-Release-Notes/ta-p/1790266?attachment-id=74671
CWE: CWE-79
CVE-2019-5445
DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: es-16-xg, es-12f, es-24-250w, es-24-500w, es-24-lite
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7, https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2019-3709
IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.
CVSS v3.0 Score: 8.3 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: emc_isilonsd_management_server
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://seclists.org/fulldisclosure/2019/Apr/16, https://seclists.org/fulldisclosure/2019/Apr/16
CWE: CWE-79
CVE-2019-1046
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage.
The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.
CVSS v3.1 Score: 4.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: windows_server_2012, windows_10, windows_server_2016, windows_7, windows_rt_8.1
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1046, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1046
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2019-12388
Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: anviz_firmware
Related CWEs: CWE-319
Related CAPECs: CAPEC-383, CAPEC-102, CAPEC-477
MITRE ATT&CK Techniques: T1056.004, T1040
MITRE ATT&CK Tactics: T1056
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html, https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CWE: CWE-319
MITRE ATT&CK techniques: T1056.004, T1040
MITRE ATT&CK tactics: T1056
CVE-2019-12827
Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
CVSS v3.0 Score: 6.5 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: asterisk, certified_asterisk
Related CWEs: CWE-787
References: http://downloads.digium.com/pub/security/AST-2019-002.html, https://issues.asterisk.org/jira/browse/ASTERISK-28447, http://downloads.digium.com/pub/security/AST-2019-002.html
CWE: CWE-787
CVE-2019-10271
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: ultimate_member
References: https://cxsecurity.com/issue/WLB-2019060120, https://cxsecurity.com/issue/WLB-2019060120
CVE-2019-9569
Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: entelibus_firmware, entelibus
Related CWEs: CWE-787
References: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hvacking-understanding-the-delta-between-security-and-reality/, https://www.deltacontrols.com/products/hvac-controls/central-plant-controllers/entelibus, https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hvacking-understanding-the-delta-between-security-and-reality/
CWE: CWE-787
CVE-2019-8693
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.6. An application may be able to read restricted memory.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: mac_os_x
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://support.apple.com/HT210348, https://support.apple.com/HT210348
CWE: CWE-125
CVE-2019-4269
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: websphere_application_server
Related CWEs: CWE-209
Related CAPECs: CAPEC-215, CAPEC-54, CAPEC-7
References: http://www.securityfocus.com/bid/109000, https://exchange.xforce.ibmcloud.com/vulnerabilities/160202, https://www-01.ibm.com/support/docview.wss?uid=ibm10884032
CWE: CWE-209
CVE-2019-9974
diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack.
CVSS v3.0 Score: 9.1 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: h660rm_firmware, h660rm
Related CWEs: CWE-862, CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: http://packetstormsecurity.com/files/152232/DASAN-H660RM-Information-Disclosure-Hardcoded-Key.html, https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/, https://seclists.org/bugtraq/2019/Mar/41
CWE: CWE-862, CWE-306
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2019-16023
Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to incorrect processing of BGP update messages that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update messages with malformed attributes to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit these vulnerabilities, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: ios_xrv_9000, ncs_5001, asr_9000, ncs_540, ncs_5011
Related CWEs: CWE-399
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-evpn, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-evpn
CWE: CWE-399
CVE-2019-0989
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the Chakra scripting engine handles objects in memory.
CVSS v3.1 Score: 4.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: chakracore, windows_10, edge, windows_server_2019, windows_server_2016
Related CWEs: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0989, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0989
CWE: CWE-787
CVE-2019-12995
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmentation fault.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: istio
Related CWEs: CWE-476
References: https://github.com/istio/istio.io/pull/4555, https://github.com/istio/istio/issues/15084, https://istio.io/about/notes/
CWE: CWE-476
CVE-2019-10417
Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
CVSS v3.1 Score: 9.9 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: kubernetes_pipeline
References: http://www.openwall.com/lists/oss-security/2019/09/25/3, https://jenkins.io/security/advisory/2019-09-25/#SECURITY-920%20%281%29, http://www.openwall.com/lists/oss-security/2019/09/25/3
CVE-2019-3710
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to intercept communications or operate the system with elevated privileges.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: emc_networking_os10
Related CWEs: CWE-798
Related CAPECs: CAPEC-191, CAPEC-70
MITRE ATT&CK Techniques: T1078.001, T1552.001
MITRE ATT&CK Tactics: T1078, T1552
References: https://www.dell.com/support/article/SLN316558/, https://www.dell.com/support/article/SLN316558/
CWE: CWE-798
MITRE ATT&CK techniques: T1078.001, T1552.001
MITRE ATT&CK tactics: T1078, T1552
CVE-2019-14364
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: email_subscribers_\&_newsletters
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/ivoschyk-cs/CVE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20%28XSS%29, https://wordpress.org/plugins/email-subscribers/#developers, https://wpvulndb.com/vulnerabilities/9508
CWE: CWE-79
CVE-2019-0598
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0599, CVE-2019-0625.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, windows_server_2016, windows_7, windows_rt_8.1
References: http://www.securityfocus.com/bid/106924, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0598, http://www.securityfocus.com/bid/106924
CVE-2019-7343
Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[Method]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
CVSS v3.0 Score: 6.1 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: zoneminder
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/ZoneMinder/zoneminder/issues/2464, https://github.com/ZoneMinder/zoneminder/issues/2464
CWE: CWE-79
CVE-2019-14707
An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI.
CVSS v3.0 Score: 7.2 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: mdc-n4090w_firmware, mdc-n4090w, mdc-n2190v, mdc-n2190v_firmware, mdc-n4090_firmware
References: http://www.microdigital.co.kr/, https://pastebin.com/PSyqqs1g, https://www.microdigital.ru/
CVE-2019-25326
ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input in the Enter Key field. Attackers can generate a 256-byte buffer of repeated 'A' characters to trigger an application crash when pasting the malicious content.
CVSS v3.1 Score: 6.2 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: ippulse
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://www.exploit-db.com/exploits/47674, https://www.netscantools.com/ippulseinfo.html, https://www.vulncheck.com/advisories/ippulse-enter-key-denial-of-service
CWE: CWE-120
CVE-2019-17151
This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to exploit this vulnerability in that the target must be within a chat session together with the attacker. The specific flaw exists within the parsing of a users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9302.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: wechat
Related CWEs: CWE-601, CWE-356
Related CAPECs: CAPEC-178
References: https://www.zerodayinitiative.com/advisories/ZDI-19-1035/, https://www.zerodayinitiative.com/advisories/ZDI-19-1035/
CWE: CWE-601, CWE-356
CVE-2019-2873
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS v3.1 Score: 3.3 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: leap, vm_virtualbox
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html, http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html, https://security.gentoo.org/glsa/202101-09
CVE-2019-0665
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0666, CVE-2019-0667, CVE-2019-0772.
CVSS v3.0 Score: 7.5 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2012, windows_10, internet_explorer, windows_server_2016, windows_7
Related CWEs: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0665, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0665
CWE: CWE-787
CVE-2019-17087
Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: acutoweb
References: https://softwaresupport.softwaregrp.com/doc/KM03569662, https://softwaresupport.softwaregrp.com/doc/KM03569662
CVE-2019-25016
In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: opendoas
Related CWEs: CWE-459, CWE-909
References: https://github.com/Duncaen/OpenDoas/commit/01c658f8c45cb92a343be5f32aa6da70b2032168, https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d, https://github.com/Duncaen/OpenDoas/issues/45
CWE: CWE-459, CWE-909