deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19252
Published: 2019-11-25
Description: vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=0c9acb1af77a3cb8707e43f45b72c95266903cee; https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb%40suse.com/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19244
Published: 2019-11-25
Description: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
CVSS Score: 7.5 (HIGH)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348; https://usn.ubuntu.com/4205-1/
CVE: CVE-2019-5825
Published: 2019-11-25
Description: Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/156641/Google-Chrome-72-73-Array.map-Corruption.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html; https://crbug.com/941743
CVE: CVE-2019-5826
Published: 2019-11-25
Description: Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html; https://crbug.com/941746; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-15629
Published: 2019-11-25
Description: Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device.
CVSS Score: 7.5 (HIGH)
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124012.aspx; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124012.aspx
CVE: CVE-2011-3351
Published: 2019-11-25
Description: openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enabled. A local attacker could use this flaw to conduct symlink attacks to overwrite arbitrary files on the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://access.redhat.com/security/cve/cve-2011-3351; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3351; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-3351
CVE: CVE-2019-17632
Published: 2019-11-25
Description: In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2011-3355
Published: 2019-11-25
Description: evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.
CVSS Score: 7.3 (HIGH)
CWE: CWE-311
References: https://access.redhat.com/security/cve/cve-2011-3355; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641052; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3355
CVE: CVE-2011-3373
Published: 2019-11-25
Description: Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2011-3373; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3373; https://www.openwall.com/lists/oss-security/2011/09/22/4
CVE: CVE-2019-10771
Published: 2019-11-25
Description: Characters in the GET url path are not properly escaped and can be reflected in the server response.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971; https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971
CVE: CVE-2011-3374
Published: 2019-11-26
Description: It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
CVSS Score: 3.7 (LOW)
CWE: CWE-347
References: https://access.redhat.com/security/cve/cve-2011-3374; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642480; https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3374.html
CVE: CVE-2011-3583
Published: 2019-11-26
Description: It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://access.redhat.com/security/cve/cve-2011-3583; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641682; https://security-tracker.debian.org/tracker/CVE-2011-3583
CVE: CVE-2011-3584
Published: 2019-11-26
Description: The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://access.redhat.com/security/cve/cve-2011-3584; https://security-tracker.debian.org/tracker/CVE-2011-3584; https://typo3.org/security/advisory/typo3-sa-2011-003/
CVE: CVE-2011-3596
Published: 2019-11-26
Description: Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://access.redhat.com/security/cve/cve-2011-3596; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644289; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3596
CVE: CVE-2019-11290
Published: 2019-11-26
Description: Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.cloudfoundry.org/blog/cve-2019-11290; https://www.cloudfoundry.org/blog/cve-2019-11290
CVE: CVE-2019-15595
Published: 2019-11-26
Description: A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://hackerone.com/reports/544928; https://hackerone.com/reports/544928
CVE: CVE-2019-18241
Published: 2019-11-26
Description: In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.us-cert.gov/ics/advisories/icsma-19-318-01; https://www.us-cert.gov/ics/advisories/icsma-19-318-01
CVE: CVE-2019-18250
Published: 2019-11-26
Description: In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://www.us-cert.gov/ics/advisories/icsa-19-318-05; https://iotsecuritynews.com/abb-power-generation-information-manager-pgim-and-plant-connect/; https://www.us-cert.gov/ics/advisories/icsa-19-318-05
CVE: CVE-2019-18251
Published: 2019-11-26
Description: In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-477
References: https://www.us-cert.gov/ics/advisories/icsa-19-318-04; https://www.zerodayinitiative.com/advisories/ZDI-19-997/; https://www.us-cert.gov/ics/advisories/icsa-19-318-04
CVE: CVE-2011-3600
Published: 2019-11-26
Description: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://mail-archives.apache.org/mod_mbox/ofbiz-user/201810.mbox/%3Cfad45546-af86-0293-9ea7-014553474b30%40apache.org%3E; https://access.redhat.com/security/cve/cve-2011-3600; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3600
CVE: CVE-2011-3606
Published: 2019-11-26
Description: A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2011-3606; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3606; https://security-tracker.debian.org/tracker/CVE-2011-3606
CVE: CVE-2011-3609
Published: 2019-11-26
Description: A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2011-3609; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3609; https://security-tracker.debian.org/tracker/CVE-2011-3609
CVE: CVE-2011-3617
Published: 2019-11-26
Description: Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://access.redhat.com/security/cve/cve-2011-3617; https://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3617.html; https://security-tracker.debian.org/tracker/CVE-2011-3617
CVE: CVE-2011-3624
Published: 2019-11-26
Description: Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://access.redhat.com/security/cve/cve-2011-3624; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3624; https://redmine.ruby-lang.org/issues/5418
CVE: CVE-2019-15271
Published: 2019-11-26
Description: A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-sbrv-cmd-x; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15271
CVE: CVE-2019-15276
Published: 2019-11-26
Description: A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device. Conversely, an unauthenticated attacker could exploit this vulnerability by persuading a user of the web interface to click the crafted URL. A successful exploit could allow the attacker to cause an unexpected restart of the device, resulting in a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/155554/Cisco-WLC-2504-8.9-Denial-Of-Service.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wlc-dos; http://packetstormsecurity.com/files/155554/Cisco-WLC-2504-8.9-Denial-Of-Service.html
CVE: CVE-2019-15284
Published: 2019-11-26
Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-webex-player; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-webex-player
CVE: CVE-2019-15286
Published: 2019-11-26
Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-webex-player; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-webex-player
CVE: CVE-2019-15288
Published: 2019-11-26
Description: A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including specific arguments when opening an SSH connection to an affected device. A successful exploit could allow the attacker to gain unrestricted user access to the restricted shell of an affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-telepres-roomos-privesc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-telepres-roomos-privesc
CVE: CVE-2019-15956
Published: 2019-11-26
Description: A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific URL in the web management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could have a twofold impact: the attacker could either change the administrator password, gaining privileged access, or reset the network configuration details, causing a denial of service (DoS) condition. In both scenarios, manual intervention is required to restore normal operations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wsa-unauth-devreset; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wsa-unauth-devreset
CVE: CVE-2019-15958
Published: 2019-11-26
Description: A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input validation during the initial High Availability (HA) configuration and registration process of an affected device. An attacker could exploit this vulnerability by uploading a malicious file during the HA registration period. A successful exploit could allow the attacker to execute arbitrary code with root-level privileges on the underlying operating system. Note: This vulnerability can only be exploited during the HA registration period. See the Details section for more information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-pi-epn-codex; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-pi-epn-codex
CVE: CVE-2019-15960
Published: 2019-11-26
Description: A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the context of the affected page. To exploit this vulnerability, the attacker must be logged in as a low-level administrator. The vulnerability is due to insufficient access control validation. An attacker could exploit this vulnerability by submitting a crafted URL request to gain privileged access in the context of the affected page. A successful exploit could allow the attacker to elevate privileges in the Webex Recording Admin page, which could allow them to view or delete recordings that they would not normally be able to access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wbs-privilege; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wbs-privilege
CVE: CVE-2019-15967
Published: 2019-11-26
Description: A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit this vulnerability by gaining unrestricted access to the restricted shell and using the specific debug commands. A successful exploit could allow the attacker to enable the microphone of an affected device to record audio without notifying users.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-telece-ros-eve; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-telece-ros-eve
CVE: CVE-2019-15973
Published: 2019-11-26
Description: A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected application. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-idn-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-idn-xss
CVE: CVE-2011-3630
Published: 2019-11-26
Description: Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/security/cve/cve-2011-3630; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630
CVE: CVE-2011-3631
Published: 2019-11-26
Description: Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/security/cve/cve-2011-3631; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3631
CVE: CVE-2011-3632
Published: 2019-11-26
Description: Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://access.redhat.com/security/cve/cve-2011-3632; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3632