deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-8143
Published: 2019-11-06
Description: A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8144
Published: 2019-11-06
Description: A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods.
CVSS Score: 9.8 (CRITICAL)
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8146
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8147
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8148
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8149
Published: 2019-11-06
Description: Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8150
Published: 2019-11-06
Description: A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout.
CVSS Score: 8.8 (HIGH)
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8151
Published: 2019-11-06
Description: A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-side request forgery due to unsafe handling of a carrier gateway.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8152
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8153
Published: 2019-11-06
Description: A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8154
Published: 2019-11-06
Description: A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8155
Published: 2019-11-06
Description: Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8159
Published: 2019-11-06
Description: A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8227
Published: 2019-11-06
Description: In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8228
Published: 2019-11-06
Description: in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8229
Published: 2019-11-06
Description: In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8230
Published: 2019-11-06
Description: In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8231
Published: 2019-11-06
Description: In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.
CVSS Score: 7.2 (HIGH)
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8232
Published: 2019-11-06
Description: In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://magento.com/security/patches/supee-11219; https://magento.com/security/patches/supee-11219
CVE: CVE-2019-8233
Published: 2019-11-06
Description: In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8132
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft malicious payload in the template Name field for Email template in the "Design Configuration" dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8145
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8156
Published: 2019-11-06
Description: A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8157
Published: 2019-11-06
Description: A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2019-8158
Published: 2019-11-06
Description: An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update; https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
CVE: CVE-2006-0061
Published: 2019-11-06
Description: xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. This allows unauthorized users access to the X session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=318123; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=399003; https://security-tracker.debian.org/tracker/CVE-2006-0061
CVE: CVE-2019-18650
Published: 2019-11-06
Description: An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-template-overrides-view.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-template-overrides-view.html
CVE: CVE-2019-18674
Published: 2019-11-06
Description: An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-path-disclosure-in-phpuft8-mapping-files.html; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-path-disclosure-in-phpuft8-mapping-files.html
CVE: CVE-2006-0062
Published: 2019-11-06
Description: xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=309760; https://security-tracker.debian.org/tracker/CVE-2006-0062; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=309760
CVE: CVE-2006-3100
Published: 2019-11-06
Description: termpkg 3.3 suffers from buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358028; https://security-tracker.debian.org/tracker/CVE-2006-3100; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=358028
CVE: CVE-2006-4243
Published: 2019-11-06
Description: linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://security-tracker.debian.org/tracker/CVE-2006-4243; https://security-tracker.debian.org/tracker/CVE-2006-4243
CVE: CVE-2006-4245
Published: 2019-11-06
Description: archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=385253; https://security-tracker.debian.org/tracker/CVE-2006-4245; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=385253
CVE: CVE-2019-18784
Published: 2019-11-06
Description: SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.10.x/; https://docs.suitecrm.com/admin/releases/7.11.x/; https://docs.suitecrm.com/admin/releases/7.10.x/
CVE: CVE-2019-18786
Published: 2019-11-06
Description: In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://patchwork.linuxtv.org/patch/59542/; https://usn.ubuntu.com/4284-1/; https://usn.ubuntu.com/4285-1/
CVE: CVE-2007-0899
Published: 2019-11-06
Description: There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security-tracker.debian.org/tracker/CVE-2007-0899; https://security-tracker.debian.org/tracker/CVE-2007-0899
CVE: CVE-2007-2841
Published: 2019-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2007-3947. Reason: This candidate is a reservation duplicate of CVE-2007-3947. Notes: All CVE users should reference CVE-2007-3947 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-10218
Published: 2019-11-06
Description: A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218; https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
CVE: CVE-2019-14833
Published: 2019-11-06
Description: A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-305, CWE-521
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14833; https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
CVE: CVE-2019-14847
Published: 2019-11-06
Description: A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14847; https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
CVE: CVE-2011-4625
Published: 2019-11-06
Description: simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security-tracker.debian.org/tracker/CVE-2011-4625; https://www.mageni.net/1.3.6.1.4.1.25623.1.0.70545; https://security-tracker.debian.org/tracker/CVE-2011-4625
CVE: CVE-2014-8181
Published: 2019-11-06
Description: The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: https://bugzilla.redhat.com/show_bug.cgi?id=1335817; https://bugzilla.redhat.com/show_bug.cgi?id=1335817
CVE: CVE-2016-4401
Published: 2019-11-06
Description: Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-010.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-010.txt
CVE: CVE-2018-20320
Published: 2019-11-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11032. Reason: This candidate is a reservation duplicate of CVE-2019-11032. Notes: All CVE users should reference CVE-2019-11032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12917
Published: 2019-11-06
Description: A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-12918
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-13076
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-13077
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a malicious link in order to attack authenticated users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-13078
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-13079
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2019-13080
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report