DuyTa/cve-kgrag-db huggingface dataset:
CVE-2019-14308
Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of service or code execution via crafted requests to the LPD service. Affected firmware versions depend on the printer models. One affected configuration is cpe:2.3:o:ricoh:sp_c250dn_firmware:-:*:*:*:*:*:*:* up to (including) 1.06 running on cpe:2.3:o:ricoh:sp_c250dn:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252dn:-:*:*:*:*:*:*:*. Another affected configuration is cpe:2.3:o:ricoh:sp_c250sf_firmware:-:*:*:*:*:*:*:* up to (including) 1.12 running on cpe:2.3:o:ricoh:sp_c250sf:-:*:*:*:*:*:*:*, cpe:2.3:o:ricoh:sp_c252sf:-:*:*:*:*:*:*:*.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: sp_c250dn, sp_c252dn, sp_c250sf_firmware, sp_c252sf_firmware, sp_c252sf
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: http://jvn.jp/en/jp/JVN11708203/index.html, https://www.ricoh-usa.com/en/support-and-download, https://www.ricoh.com/info/2019/0823_1/
CWE: CWE-119
CVE-2019-2322
Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: snapdragon_high_med_2016_firmware, sd_712_firmware, sd_415_firmware, sd_675, sd_210_firmware
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://www.qualcomm.com/company/product-security/bulletins, https://www.qualcomm.com/company/product-security/bulletins
CWE: CWE-119
CVE-2019-1989
In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118399205
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: android
Related CWEs: CWE-787
References: https://source.android.com/security/bulletin/2019-03-01, https://source.android.com/security/bulletin/2019-03-01
CWE: CWE-787
CVE-2019-15562
GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: gorm
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/go-gorm/gorm/issues/2517#issuecomment-638145427, https://github.com/go-gorm/gorm/pull/2519, https://github.com/go-gorm/gorm/pull/2674
CWE: CWE-89
CVE-2019-15080
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: morph
References: https://etherscan.io/address/0x2ef27bf41236bd859a95209e17a43fbd26851f92#contracts, https://github.com/smsecgroup/SM-VUL/tree/master/typo-vul-02, https://etherscan.io/address/0x2ef27bf41236bd859a95209e17a43fbd26851f92#contracts
CVE-2019-9871
Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: fm-k75, fm-k75_firmware
Related CWEs: CWE-306
Related CAPECs: CAPEC-216, CAPEC-12, CAPEC-36
References: http://www.nccst.nat.gov.tw, https://github.com/cvereveal/CVEs/tree/master/CVE-2019-9871, http://www.nccst.nat.gov.tw
CWE: CWE-306
CVE-2019-10389
A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: relution_enterprise_appstore_publisher
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: http://www.openwall.com/lists/oss-security/2019/08/07/1, https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1053, http://www.openwall.com/lists/oss-security/2019/08/07/1
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2019-3739
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: bsafe_crypto-j, retail_predictive_application_server, storagetek_acsls, retail_service_backbone, goldengate
Related CWEs: CWE-203, CWE-310
Related CAPECs: CAPEC-189
References: https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities, https://www.oracle.com//security-alerts/cpujul2021.html, https://www.oracle.com/security-alerts/cpuApr2021.html
CWE: CWE-203, CWE-310
CVE-2019-12387
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: zfs_storage_appliance_kit, fedora, twisted, solaris, ubuntu_linux
Related CWEs: CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html, http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html, https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2
CWE: CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2019-4039
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting system. IBM X-Force ID: 156163.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected Products: websphere_mq
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156163, https://www.ibm.com/support/docview.wss?uid=ibm10870492, https://exchange.xforce.ibmcloud.com/vulnerabilities/156163
CVE-2019-16714
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: linux_kernel, traffix_signaling_delivery_controller, ubuntu_linux
Related CWEs: CWE-909
References: http://www.openwall.com/lists/oss-security/2019/09/24/2, http://www.openwall.com/lists/oss-security/2019/09/25/1, https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.14
CWE: CWE-909
CVE-2019-25410
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through the source and destination parameters. Attackers can submit POST requests to the policy routing endpoint with script payloads in these parameters to execute arbitrary JavaScript in users' browsers.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products: dome_firewall
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://cdome.comodo.com/firewall/, https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278, https://www.exploit-db.com/exploits/46408
CWE: CWE-79
CVE-2019-20573
An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the RCS Content Provider. The Samsung IDs are SVE-2019-14059, SVE-2019-14685 (August 2019).
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: android
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://security.samsungmobile.com/securityUpdate.smsb, https://security.samsungmobile.com/securityUpdate.smsb
CWE: CWE-89
CVE-2019-8570
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.1.3, iCloud for Windows 7.10, iTunes 12.9.3 for Windows, Safari 12.0.3, tvOS 12.1.2. Processing maliciously crafted web content may disclose sensitive user information.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: tvos, iphone_os, itunes, icloud, safari
References: https://support.apple.com/en-us/HT209443, https://support.apple.com/en-us/HT209447, https://support.apple.com/en-us/HT209449
CVE-2019-1577
Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
CVSS v3.0 Score: 6.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: traps
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: http://www.securityfocus.com/bid/109053, https://security.paloaltonetworks.com/CVE-2019-1577, http://www.securityfocus.com/bid/109053
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2019-14362
Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.
CVSS v3.0 Score: 5.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v2.0 Score: 5.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Affected Products: openbravo_erp
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://grep.blog/directory-traversal-openbravo/, https://issues.openbravo.com/view.php?id=41413, https://www.sitincloud.com/securite/directory-traversal-openbravo-erp/
CWE: CWE-22
CVE-2019-11819
Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/accounts/user_new.jsp) via the First Name or Last Name.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: opencms
Related CWEs: CWE-1236
References: https://github.com/alkacon/opencms-core/issues/636, https://www.openwall.com/lists/oss-security/2019/05/05/2, https://github.com/alkacon/opencms-core/issues/636
CWE: CWE-1236
CVE-2019-5944
Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address' without modify privileges via the application 'Address'.
CVSS v3.0 Score: 4.3 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: garoon
References: http://jvn.jp/en/jp/JVN58849431/index.html, https://kb.cybozu.support/article/35487/, http://jvn.jp/en/jp/JVN58849431/index.html
CVE-2019-12576
A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This program is called during the connection process and executes several operating system utilities to configure the system. The networksetup utility is called using relative paths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup trojan which will be executed during the connection process. This is possible because the PATH environment variable is not reset prior to executing the OS utility.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: private_internet_access_vpn_client, macos
Related CWEs: CWE-426
Related CAPECs: CAPEC-38
MITRE ATT&CK Techniques: T1574.007, T1574.009
MITRE ATT&CK Tactics: T1574
References: https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12576.txt, https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12576.txt
CWE: CWE-426
MITRE ATT&CK techniques: T1574.007, T1574.009
MITRE ATT&CK tactics: T1574
CVE-2019-14570
Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: nuc_8_mainstream_game_mini_computer, nuc_kit_de3815tykhe, nuc_kit_dn2820fykh_firmware, nuc_board_de3815tybe_firmware, nuc_board_de3815tybe
Related CWEs: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00296.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00296.html
CWE: CWE-787
CVE-2019-18996
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v2.0 Score: 4.4 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Affected Products: pb610_panel_builder_600
Related CWEs: CWE-424, CWE-426
Related CAPECs: CAPEC-38, CAPEC-127, CAPEC-554
MITRE ATT&CK Techniques: T1083, T1574.007, T1574.009
MITRE ATT&CK Tactics: T1574
References: http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch, http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch
CWE: CWE-424, CWE-426
MITRE ATT&CK techniques: T1083, T1574.007, T1574.009
MITRE ATT&CK tactics: T1574
CVE-2019-25097
A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component Directory Content Handler. The manipulation leads to path traversal. Upgrading to version 2.1.13 is able to address this issue. The name of the patch is b8fcb888f4ff5e171c16797a4b075c6c6f50bf46. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217436.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 Score: 5.2 (MEDIUM)
CVSS v2.0 Vector: AV:A/AC:L/Au:S/C:P/I:P/A:P
Affected Products: extplorer
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://github.com/soerennb/extplorer/commit/b8fcb888f4ff5e171c16797a4b075c6c6f50bf46, https://github.com/soerennb/extplorer/releases/tag/v2.1.13, https://vuldb.com/?ctiid.217436
CWE: CWE-22
CVE-2019-25147
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected Products: pretty_links
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://blog.nintechnet.com/stored-xss-and-csv-injection-vulnerabilities-in-wordpress-shortlinks-by-pretty-links-plugin/, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2108490%40pretty-link%2Ftrunk&old=2078274%40pretty-link%2Ftrunk&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae058c5b-b90b-4a1e-9f56-d56dbd2d3607?source=cve
CWE: CWE-79
CVE-2019-13316
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8757.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: windows, phantompdf, reader
Related CWEs: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php, https://www.zerodayinitiative.com/advisories/ZDI-19-633/, https://www.foxitsoftware.com/support/security-bulletins.php
CWE: CWE-416
CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: fedora, hunspell
Related CWEs: CWE-119
Related CAPECs: CAPEC-14, CAPEC-45, CAPEC-9
References: https://github.com/butterflyhack/hunspell-crash, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24NTBHK2QNYKSBMJI34WEU5MHS3H2FAI/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2YOYFI36IWKABNGFTWXCH7TTGAFODH6/
CWE: CWE-119
CVE-2019-5086
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: xcftools, debian_linux
Related CWEs: CWE-680, CWE-190, CWE-787
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://lists.debian.org/debian-lts-announce/2021/02/msg00014.html, https://lists.debian.org/debian-lts-announce/2021/03/msg00008.html, https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878
CWE: CWE-680, CWE-190, CWE-787
CVE-2019-15788
Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: clara_genomics_analysis
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://github.com/clara-genomics/ClaraGenomicsAnalysis/compare/6dc3061...416af9f, https://github.com/clara-genomics/ClaraGenomicsAnalysis/pull/70, https://github.com/clara-genomics/ClaraGenomicsAnalysis/compare/6dc3061...416af9f
CWE: CWE-190
CVE-2019-11217
The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http request.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: bonobo_git_server
Related CWEs: CWE-77
Related CAPECs: CAPEC-43, CAPEC-183, CAPEC-76
References: https://bonobogitserver.com/changelog/#version-650, https://flab.cesnet.cz/advisories/cve-2019-11217, https://bonobogitserver.com/changelog/#version-650
CWE: CWE-77
CVE-2019-7585
An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: waimai_super_cms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/caokang/waimai/issues/11, https://github.com/caokang/waimai/issues/11
CWE: CWE-89
CVE-2019-1828
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to access administrative credentials. The vulnerability exists because affected devices use weak encryption algorithms for user credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack and decrypting intercepted credentials. A successful exploit could allow the attacker to gain access to an affected device with administrator privileges. This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases prior to 1.4.2.22.
CVSS v3.0 Score: 5.9 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: rv325, rv320, rv325_firmware, rv320_firmware
Related CWEs: CWE-327
Related CAPECs: CAPEC-614, CAPEC-97, CAPEC-459
MITRE ATT&CK Techniques: T1553.002, T1036.001
MITRE ATT&CK Tactics: T1553, T1036
References: http://www.securityfocus.com/bid/107774, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190404-rv-weak-encrypt, http://www.securityfocus.com/bid/107774
CWE: CWE-327
MITRE ATT&CK techniques: T1553.002, T1036.001
MITRE ATT&CK tactics: T1553, T1036
CVE-2019-15356
The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: flair_z1, flair_z1_firmware
References: https://www.kryptowire.com/android-firmware-2019/, https://www.kryptowire.com/android-firmware-2019/
CVE-2019-16977
In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: fusionpbx
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/fusionpbx/fusionpbx/commit/fc8e4e2d278ce6bffff21b04248d469a59eb8cd4, https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-10/, https://github.com/fusionpbx/fusionpbx/commit/fc8e4e2d278ce6bffff21b04248d469a59eb8cd4
CWE: CWE-79
CVE-2019-15389
The Haier A6 Android device with a build fingerprint of Haier/A6/A6:8.1.0/O11019/1534219877:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.1.13). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. In addition to the local attack surface, its accompanying app with a package name of com.ekesoo.lovelyhifonts makes network requests using HTTP and an attacker can perform a Man-in-the-Middle (MITM) attack on the connection to inject a command in a network response that will be executed as the system user by the com.lovelyfont.defcontainer app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS v3.1 Score: 8.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.3 (HIGH)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected Products: haier_a6_firmware, haier_a6
References: https://www.kryptowire.com/android-firmware-2019/, https://www.kryptowire.com/android-firmware-2019/
CVE-2019-6014
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 8.3 (HIGH)
CVSS v2.0 Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C
Affected Products: dba-1510p, dba-1510p_firmware
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: http://jvn.jp/en/jp/JVN95875796/index.html, https://www.dlink-jp.com/product/dba-1510p#product_firmware, http://jvn.jp/en/jp/JVN95875796/index.html
CWE: CWE-78
CVE-2019-2760
Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23 and 12.1.6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.0 Score: 7.0 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 3.7 (LOW)
CVSS v2.0 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P
Affected Products: berkeley_db
References: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html, http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE-2019-9775
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec.
CVSS v3.1 Score: 9.1 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P
Affected Products: leap, backports_sle, libredwg
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html, http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html, http://www.securityfocus.com/bid/107447
CWE: CWE-125
CVE-2019-25603
TuneClone 2.20 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious license code string. Attackers can craft a payload with a controlled buffer, NSEH jump instruction, and SEH handler address pointing to a ROP gadget, then paste it into the license code field to trigger code execution and establish a bind shell.
CVSS v3.1 Score: 8.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-787
References: http://www.tuneclone.com/, http://www.tuneclone.com/tuneclone_setup.exe, https://www.exploit-db.com/exploits/47012
CWE: CWE-787
CVE-2019-1239
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1238.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.6 (HIGH)
CVSS v2.0 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Affected Products: windows_server_2019, windows_10, internet_explorer
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239
CVE-2019-14310
Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash. A memory corruption has been identified in the way of how the embedded device parsed the IPP packets
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: sp_c250dn, sp_c252dn, sp_c250sf_firmware, sp_c252sf_firmware, sp_c252sf
Related CWEs: CWE-787
References: https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/, https://www.ricoh-usa.com/en/support-and-download, https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-ricoh-printers/
CWE: CWE-787
CVE-2019-16564
Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: pipeline_aggregator_view
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.openwall.com/lists/oss-security/2019/12/17/1, https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1593, http://www.openwall.com/lists/oss-security/2019/12/17/1
CWE: CWE-79
CVE-2019-3751
Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victim’s data in transit.
CVSS v3.0 Score: 6.4 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v2.0 Score: 5.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Affected Products: emc_enterprise_copy_data_management
Related CWEs: CWE-295
Related CAPECs: CAPEC-475, CAPEC-459
References: https://www.dell.com/support/security/en-us/details/536848/DSA-2019-118-Dell-EMC-Enterprise-Copy-Data-Management-eCDM-Improper-Certificate-Validation-Vuln, https://www.dell.com/support/security/en-us/details/536848/DSA-2019-118-Dell-EMC-Enterprise-Copy-Data-Management-eCDM-Improper-Certificate-Validation-Vuln
CWE: CWE-295
CVE-2019-8459
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.
CVSS v3.0 Score: 9.8 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: remote_access_clients, smartconsole_for_endpoint_security_server, endpoint_security_server_package, capsule_docs_standalone_client, jumbo_hotfix_for_endpoint_security_server
Related CWEs: CWE-428
References: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues, https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues
CWE: CWE-428
CVE-2019-5425
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 9.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Affected Products: edgeswitch_x
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137, https://hackerone.com/reports/511025, https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137
CWE: CWE-78
CVE-2019-15781
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
CVSS v3.0 Score: 8.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: social_likebox_\&_feed
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://wordpress.org/plugins/facebook-by-weblizar/#developers, https://wpvulndb.com/vulnerabilities/9851, https://wordpress.org/plugins/facebook-by-weblizar/#developers
CWE: CWE-352
CVE-2019-0091
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
CVSS v3.0 Score: 7.8 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: trusted_execution_technology, converged_security_and_management_engine
Related CWEs: CWE-94
Related CAPECs: CAPEC-242, CAPEC-77, CAPEC-35
MITRE ATT&CK Techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK Tactics: T1564, T1027
References: https://support.f5.com/csp/article/K21423526, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html, https://support.f5.com/csp/article/K21423526
CWE: CWE-94
MITRE ATT&CK techniques: T1027.006, T1564.009, T1027.009
MITRE ATT&CK tactics: T1564, T1027
CVE-2019-10766
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: pixie
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://snyk.io/vuln/SNYK-PHP-USMANHALALITPIXIE-534879, https://snyk.io/vuln/SNYK-PHP-USMANHALALITPIXIE-534879
CWE: CWE-89
CVE-2019-5518
VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 11.0.3, 10.x before 10.1.6) contain an out-of-bounds read/write vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface). Exploitation of this issue requires an attacker to have access to a virtual machine with a virtual USB controller present. This issue may allow a guest to execute code on the host.
CVSS v3.0 Score: 6.8 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: fusion, esxi, workstation
Related CWEs: CWE-125, CWE-787
Related CAPECs: CAPEC-540
References: http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html, http://www.securityfocus.com/bid/107541, https://www.vmware.com/security/advisories/VMSA-2019-0005.html
CWE: CWE-125, CWE-787
CVE-2019-19382
Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replace a .exe or .dll file to achieve privilege escalation.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.6 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Affected Products: anti_virus_plus
Related CWEs: CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: http://hyp3rlinx.altervista.org, http://packetstormsecurity.com/files/155506/Max-Secure-Anti-Virus-Plus-19.0.4.020-Insecure-Permissions.html, http://hyp3rlinx.altervista.org
CWE: CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2019-6261
An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.
CVSS v3.0 Score: 6.1 (MEDIUM)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: joomla\!
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://www.securityfocus.com/bid/106638, https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact, http://www.securityfocus.com/bid/106638
CWE: CWE-79
CVE-2019-25365
ChaosPro 2.0 contains a buffer overflow vulnerability in the configuration file path handling that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious configuration file with carefully constructed payload to overwrite memory and gain remote code execution on vulnerable Windows XP systems.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CWEs: CWE-121
References: http://www.chaospro.de/, https://www.exploit-db.com/exploits/47551, https://www.vulncheck.com/advisories/chaospro-buffer-overflow
CWE: CWE-121
CVE-2019-2775
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Payments. CVSS 3.0 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVSS v3.0 Score: 9.1 (CRITICAL)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v2.0 Score: 6.4 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P
Affected Products: payments
References: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html, http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE-2019-8422
A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.
CVSS v3.0 Score: 7.2 (HIGH)
CVSS v3.0 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: pbootcms
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/wowwooo/vnotes/blob/master/PbootCMS%20SQL%20Injection%20Description.md, https://github.com/wowwooo/vnotes/blob/master/PbootCMS%20SQL%20Injection%20Description.md
CWE: CWE-89
CVE-2019-15253
A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs administrator credentials. This vulnerability affects Cisco DNA Center Software releases earlier than 1.3.0.6 and 1.3.1.4.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: catalyst_center
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://packetstormsecurity.com/files/157668/Cisco-Digital-Network-Architecture-Center-1.3.1.4-Cross-Site-Scripting.html, https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190205-dnac-xss, http://packetstormsecurity.com/files/157668/Cisco-Digital-Network-Architecture-Center-1.3.1.4-Cross-Site-Scripting.html
CWE: CWE-79
CVE-2019-16927
Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-9877.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: xpdf
Related CWEs: CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41885, https://forum.xpdfreader.com/viewtopic.php?f=3&t=41885
CWE: CWE-787
CVE-2019-6742
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: galaxy_s9_firmware, galaxy_s9
Related CWEs: CWE-358
References: https://www.zerodayinitiative.com/advisories/ZDI-19-255/, https://www.zerodayinitiative.com/advisories/ZDI-19-255/
CWE: CWE-358
CVE-2019-9416
In libstagefright there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111804142
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Affected Products: android
Related CWEs: CWE-908
References: https://source.android.com/security/bulletin/android-10, https://source.android.com/security/bulletin/android-10
CWE: CWE-908
CVE-2019-20438
An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been identified in the inline API documentation editor page of the API Publisher.
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: api_manager
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://cybersecurityworks.com/zerodays/cve-2019-20438-wso2.html, https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0645, https://github.com/cybersecurityworks/Disclosed/issues/22
CWE: CWE-79
CVE-2019-15616
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products: nextcloud_server
Related CWEs: CWE-93, CWE-74
Related CAPECs: CAPEC-53, CAPEC-51, CAPEC-9
MITRE ATT&CK Techniques: T1574.006, T1574.007, T1027
MITRE ATT&CK Tactics: T1562, T1574
References: https://hackerone.com/reports/592864, https://nextcloud.com/security/advisory/?id=NC-SA-2020-005, https://hackerone.com/reports/592864
CWE: CWE-93, CWE-74
MITRE ATT&CK techniques: T1574.006, T1574.007, T1027, T1562.003
MITRE ATT&CK tactics: T1562, T1574
CVE-2019-2585
Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: enterprise_linux, enterprise_linux_server_tus, enterprise_linux_server_aus, fedora, mysql
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html, https://access.redhat.com/errata/RHSA-2019:2484, https://access.redhat.com/errata/RHSA-2019:2511