alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2019-1218 (published 2019-08-14)
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim.
The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user.
The security update addresses the vulnerability by correcting how Outlook iOS parses specially crafted email messages.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: outlook
CVE-2019-12180 (published 2020-02-05)
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: smartbear
Affected products: readyapi, soapui
CVE-2019-12181 (published 2019-06-17)
A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: solarwinds
Affected products: serv-u_ftp_server, serv-u_mft_server
CVE-2019-12182 (published 2020-03-13)
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: safescan
Affected products: ta-8010, ta-8010_firmware, ta-8015, ta-8015_firmware, ta-8020, ta-8020_firmware, ta-8025, ta-8025_firmware, ta-8030, ta-8030_firmware, ta-8035, ta-8035_firmware, tm-616, tm-616_firmware
CVE-2019-12183 (published 2020-03-02)
Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-269
Affected vendors: safescan
Affected products: ta-8010, ta-8010_firmware, ta-8015, ta-8015_firmware, ta-8020, ta-8020_firmware, ta-8025, ta-8025_firmware, ta-8030, ta-8030_firmware, ta-8035, ta-8035_firmware, timemoto_tm-616, timemoto_tm-616_firmware
CVE-2019-12184 (published 2019-05-19)
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: boostio
Affected products: boostnote
CVE-2019-12185 (published 2019-05-20)
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: elabftw
Affected products: elabftw
CVE-2019-12186 (published 2019-12-31)
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: sylius
Affected products: grid, sylius
CVE-2019-12189 (published 2019-05-21)
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zohocorp
Affected products: manageengine_servicedesk_plus
CVE-2019-1219 (published 2019-09-11)
An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2019-12190 (published 2019-05-21)
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: control-webpanel
Affected products: webpanel
CVE-2019-12193 (published 2019-07-19)
H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: h3c
Affected products: h3cloud_os
CVE-2019-12195 (published 2019-05-24)
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tp-link
Affected products: tl-wr840n, tl-wr840n_firmware
CVE-2019-12196 (published 2019-06-05)
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zohocorp
Affected products: manageengine_netflow_analyzer
CVE-2019-12198 (published 2019-05-20)
In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: gohttp_project
Affected products: gohttp
CVE-2019-1220 (published 2019-09-11)
A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-425
Affected vendors: microsoft
Affected products: edge, internet_explorer, windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2019-12203 (published 2019-09-25)
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2019-12204 (published 2019-09-25)
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2019-12205 (published 2019-09-25)
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2019-12206 (published 2019-05-20)
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: f5
Affected products: njs
CVE-2019-12207 (published 2019-05-20)
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: f5
Affected products: njs
CVE-2019-12208 (published 2019-05-20)
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: f5
Affected products: njs
CVE-2019-12209 (published 2019-06-04)
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-59
Affected vendors: yubico
Affected products: pam-u2f
CVE-2019-1221 (published 2019-09-11)
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: internet_explorer, windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2019-12210 (published 2019-06-04)
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected vendors: yubico
Affected products: pam-u2f
CVE-2019-12211 (published 2019-05-20)
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: canonical, freeimage_project
Affected products: freeimage, ubuntu_linux
CVE-2019-12212 (published 2019-05-20)
When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: freeimage_project
Affected products: freeimage
CVE-2019-12213 (published 2019-05-20)
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: canonical, debian, fedoraproject, freeimage_project
Affected products: debian_linux, fedora, freeimage, ubuntu_linux
CVE-2019-12214 (published 2019-05-20)
In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c. The value of l_N_ppm comes from the file read in, and the code does not consider that l_N_ppm may be greater than the size of p_header_data.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: freeimage_project
Affected products: freeimage
CVE-2019-12215 (published 2019-05-20)
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-209
Affected vendors: matomo
Affected products: matomo
CVE-2019-12216 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: canonical, debian, fedoraproject, libsdl
Affected products: debian_linux, fedora, sdl2_image, simple_directmedia_layer, ubuntu_linux
CVE-2019-12217 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: libsdl
Affected products: sdl2_image, simple_directmedia_layer
CVE-2019-12218 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: libsdl
Affected products: sdl2_image, simple_directmedia_layer
CVE-2019-12219 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: libsdl
Affected products: sdl2_image, simple_directmedia_layer
CVE-2019-1222 (published 2019-08-14)
A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12220 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: libsdl
Affected products: sdl2_image, simple_directmedia_layer
CVE-2019-12221 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: canonical, debian, fedoraproject, libsdl, opensuse
Affected products: backports_sle, debian_linux, fedora, leap, sdl2_image, simple_directmedia_layer, ubuntu_linux
CVE-2019-12222 (published 2019-05-20)
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: libsdl
Affected products: simple_directmedia_layer
CVE-2019-12223 (published 2019-09-05)
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: hanwha-security
Affected products: srn-1673s, srn-1673s_firmware, srn-472s, srn-472s_firmware, srn-873s, srn-873s_firmware
CVE-2019-1223 (published 2019-08-14)
A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on the target system to stop responding.
To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides Remote Desktop Protocol (RDP) services.
The update addresses the vulnerability by correcting how RDP handles connection requests.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12239 (published 2019-05-20)
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wpbookingsystem
Affected products: wp_booking_system
CVE-2019-1224 (published 2019-08-14)
An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the system.
To exploit this vulnerability, an attacker would have to connect remotely to an affected system and run a specially crafted application.
The security update addresses the vulnerability by correcting how the Windows RDP server initializes memory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12240 (published 2019-05-20)
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: virim_project
Affected products: virim
CVE-2019-12241 (published 2019-05-20)
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: carts.guru
Affected products: carts_guru
CVE-2019-12243 (published 2019-06-05)
Istio 1.1.x through 1.1.6 has Incorrect Access Control.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: istio
Affected products: istio
CVE-2019-12245 (published 2019-09-25)
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-732
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2019-12246 (published 2020-02-19)
SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Weakness: CWE-352
Affected vendors: silverstripe
Affected products: silverstripe
CVE-2019-12247 (published 2019-05-22)
QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. NOTE: This has been disputed as not exploitable
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: qemu
Affected products: qemu
CVE-2019-12248 (published 2019-06-17)
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: debian, otrs
Affected products: debian_linux, otrs
CVE-2019-1225 (published 2019-08-14)
An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the system.
To exploit this vulnerability, an attacker would have to connect remotely to an affected system and run a specially crafted application.
The security update addresses the vulnerability by correcting how the Windows RDP server initializes memory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12250 (published 2019-05-21)
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not part of IdentityServer but only our development test host
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: identityserver
Affected products: identityserver4
CVE-2019-12251 (published 2019-05-21)
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ucms_project
Affected products: ucms
CVE-2019-12252 (published 2019-05-21)
In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-639
Affected vendors: zohocorp
Affected products: manageengine_servicedesk_plus
CVE-2019-12253 (published 2019-05-21)
my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: mylittleforum
Affected products: my_little_forum
CVE-2019-12254 (published 2022-05-06)
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: gok, tecson
Affected products: e-litro_net, e-litro_net_firmware, lx-net, lx-net_firmware, lx-q-net, lx-q-net_firmware, smartbox_4_lan, smartbox_4_lan_firmware, smartbox_4_lan_pro, smartbox_4_lan_pro_firmware
CVE-2019-12255 (published 2019-08-09)
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12256 (published 2019-08-09)
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12257 (published 2019-08-09)
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12258 (published 2019-08-09)
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-384
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12259 (published 2019-08-09)
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: belden, siemens, sonicwall, windriver
Affected products: 9410_power_meter, 9410_power_meter_firmware, 9810_power_meter, 9810_power_meter_firmware, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40
CVE-2019-1226 (published 2019-08-14)
A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12260 (published 2019-08-09)
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: belden, netapp, oracle, siemens, sonicwall, windriver
Affected products: communications_eagle, e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite
CVE-2019-12261 (published 2019-08-09)
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: belden, netapp, oracle, siemens, sonicwall, windriver
Affected products: communications_eagle, e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite
CVE-2019-12262 (published 2019-08-14)
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Reverse ARP replies (Logical Flaw).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: belden, siemens, windriver
Affected products: garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart, hirschmann_red25
CVE-2019-12263 (published 2019-08-09)
Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12264 (published 2019-08-05)
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-88
Affected vendors: belden, siemens, windriver
Affected products: garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart, hirschmann_red25
CVE-2019-12265 (published 2019-08-09)
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-401
Affected vendors: belden, netapp, siemens, sonicwall, windriver
Affected products: e-series_santricity_os_controller, garrettcom_magnum_dx940e, garrettcom_magnum_dx940e_firmware, hirschmann_dragon_mach4000, hirschmann_dragon_mach4500, hirschmann_eagle20, hirschmann_eagle30, hirschmann_eagle_one, hirschmann_ees20, hirschmann_ees25, hirschmann_eesx20, hirschmann_eesx30, hirschmann_grs1020, hirschmann_grs1030, hirschmann_grs1042, hirschmann_grs1120, hirschmann_grs1130, hirschmann_grs1142, hirschmann_hios, hirschmann_msp30, hirschmann_msp32, hirschmann_msp40, hirschmann_octopus_os3, hirschmann_rail_switch_power_lite, hirschmann_rail_switch_power_smart
CVE-2019-12266 (published 2022-03-30)
Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: wyze
Affected products: cam_pan_v2, cam_pan_v2_firmware, cam_v2, cam_v2_firmware, cam_v3, cam_v3_firmware
CVE-2019-12269 (published 2019-05-21)
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-347
Affected vendors: enigmail
Affected products: enigmail
CVE-2019-1227 (published 2019-08-14)
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-12270 (published 2019-05-21)
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The share is used to retrieve documents for processing, and to store processed documents for display in the browser. The only required share level access is read/write by the JobProcessor service account. At the local filesystem level, the only additional required permissions would be read/write from the servlet engine, such as Tomcat. (The affected server components are not installed with Content Server by default, and must be installed separately.) NOTE: the vendor's position is that customers are not supposed to use this default setting without consulting the documentation.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-732
Affected vendors: microsoft, opentext
Affected products: brava\!, windows
CVE-2019-12271 (published 2019-11-18)
Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: sandline
Affected products: centraleyezer
CVE-2019-12272 (published 2019-05-23)
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: openwrt
Affected products: luci
CVE-2019-12273 (published 2019-12-31)
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The vendor claims that the independent researcher created the report without any type of validation and that no such vulnerability exists
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: outsystems
Affected products: outsystems
CVE-2019-12274 (published 2019-06-06)
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: suse
Affected products: rancher
CVE-2019-12276 (published 2019-06-05)
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: grandnode
Affected products: grandnode
CVE-2019-12277 (published 2019-05-22)
Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. in a pathname.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: blogifier
Affected products: blogifier
CVE-2019-12278 (published 2020-03-12)
Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numerical IP address or an alphabetic string, leading to a spoofed URL.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: opera
Affected products: opera
CVE-2019-12279 (published 2019-05-22)
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: nagios
Affected products: nagios_xi
CVE-2019-1228 (published 2019-08-14)
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_server_2008
CVE-2019-12280 (published 2019-06-25)
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: dell, pc-doctor
Affected products: supportassist_for_business_pcs, supportassist_for_home_pcs, toolbox
CVE-2019-12288 (published 2019-05-23)
An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service, network, and account files can be manipulated through a web UI firmware update without any authentication. The attacker can achieve access to the device through a manipulated web UI firmware update.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: vstarcam, vstracm
Affected products: c38s, c38s_firmware, c7824iwp, c7824iwp_firmware
CVE-2019-12289 (published 2019-05-23)
An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: vstracam
Affected products: c38s, c38s_firmware, c7824wip, c7824wip_firmware
CVE-2019-1229 (published 2019-08-14)
An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation.
To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code.
The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: dynamics_365
CVE-2019-12290 (published 2019-10-22)
GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: gnu
Affected products: libidn2
CVE-2019-12291 (published 2019-06-06)
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: hashicorp
Affected products: consul