deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-12778
Published: 2019-05-09
Description: The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file at the C:\Users\<username>\Roaming\qBittorrent pathname. The attacker must change the value of the "locked" attribute to "false" within the "Locking" stanza. NOTE: This is an intended behavior. See https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://archive.is/eF2GR; https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password; https://medium.com/%40BaYinMin/cve-2017-12778-qbittorrent-ui-lock-authentication-bypass-30959ff55ada
CVE: CVE-2017-12790
Published: 2019-05-09
Description: Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md; https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md
CVE: CVE-2017-12839
Published: 2019-05-09
Description: A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.
CVSS Score: 8.3 (HIGH)
CWE: CWE-125
References: https://sourceforge.net/p/mpg123/bugs/255/; https://www.mpg123.de/; https://www.mpg123.de/cgi-bin/scm/mpg123/trunk/src/libmpg123/getbits.h?r1=2024&r2=4323&sortby=date
CVE: CVE-2017-12757
Published: 2019-05-09
Description: Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image Sharing Script 4.13i and Tech Job Script 9.27i and Tech Movie Script 7.51i and Tech Multi Vendor Script 6.63i and Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://ambit.com; http://itech.com; https://www.exploit-db.com/exploits/42507
CVE: CVE-2017-12758
Published: 2019-05-09
Description: https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is: com_appointment component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://joomlaextension.biz/appointment/; https://www.exploit-db.com/exploits/42492; http://joomlaextension.biz/appointment/
CVE: CVE-2017-12759
Published: 2019-05-09
Description: Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution (remote).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://demo.ynetinteractive.com/soa/; http://soa.com; https://www.exploit-db.com/exploits/42499
CVE: CVE-2017-12760
Published: 2019-05-09
Description: Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution (remote).
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://demo.ynetinteractive.com/mobiketa/index.php?url=myCampaign&view=-9999%27+/%2A%2150000union%2A/+select=%5BSQL%5D; https://www.exploit-db.com/exploits/41283; http://demo.ynetinteractive.com/mobiketa/index.php?url=myCampaign&view=-9999%27+/%2A%2150000union%2A/+select=%5BSQL%5D
CVE: CVE-2017-12761
Published: 2019-05-09
Description: http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file = $_GET['id'] in download.php. The attack vector is: http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://codecanyon.net/user/Endober; http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php; http://webfile.com
CVE: CVE-2019-11842
Published: 2019-05-09
Description: An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/; https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
CVE: CVE-2019-1568
Published: 2019-05-09
Description: Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrary JavaScript or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.paloaltonetworks.com/CVE-2019-1568; https://security.paloaltonetworks.com/CVE-2019-1568
CVE: CVE-2019-11563
Published: 2019-05-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2016-1600
Published: 2019-05-09
Description: The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html#t433o7au0niu; https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html#t433o7au0niu
CVE: CVE-2019-7652
Published: 2019-05-09
Description: TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html; https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/; http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html
CVE: CVE-2018-20837
Published: 2019-05-09
Description: include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Typesetter/Typesetter/commit/fd637e2919e7f77c498a91a8e9d353f8e12afc9a; https://www.netsparker.com/web-applications-advisories/ns-18-026-reflected-cross-site-scripting-in-typesetter/; https://github.com/Typesetter/Typesetter/commit/fd637e2919e7f77c498a91a8e9d353f8e12afc9a
CVE: CVE-2019-11869
Published: 2019-05-09
Description: The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9254; https://www.pluginvulnerabilities.com/2019/03/30/wordpress-plugin-team-paints-target-on-exploitable-settings-change-vulnerability-that-permits-persistent-xss-in-related-posts/; https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild/
CVE: CVE-2019-11870
Published: 2019-05-09
Description: Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/05/10/1; https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html; https://github.com/s9y/Serendipity/issues/598
CVE: CVE-2019-11871
Published: 2019-05-10
Description: The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.reddy.io/2019/05/30/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin/; https://wordpress.org/plugins/custom-field-suite/#developers; https://wpvulndb.com/vulnerabilities/9273
CVE: CVE-2019-1867
Published: 2019-05-10
Description: A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507-esc-authbypass
CVE: CVE-2015-1006
Published: 2019-05-10
Description: A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01
CVE: CVE-2017-12789
Published: 2019-05-10
Description: Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/delete.php. The attack vector is: The administrator clicks on the malicious link in the login state.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md; https://github.com/lemon666/vuln/blob/master/MetInfo5.3.md
CVE: CVE-2017-12795
Published: 2019-05-10
Description: OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://openmrs-module-htmlformentry.com; http://openmrs.com; https://github.com/openmrs/openmrs-module-htmlformentry/commit/86f35221c8a57cdd7557ce731a56b90db216c8e0
CVE: CVE-2017-12885
Published: 2019-05-10
Description: OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://app.com; http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE: CVE-2018-1790
Published: 2019-05-10
Description: IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=ibm10731607; https://exchange.xforce.ibmcloud.com/vulnerabilities/148944; http://www.ibm.com/support/docview.wss?uid=ibm10731607
CVE: CVE-2018-1990
Published: 2019-05-10
Description: IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/108327; https://exchange.xforce.ibmcloud.com/vulnerabilities/154283; https://www.ibm.com/support/docview.wss?uid=ibm10883350
CVE: CVE-2019-11878
Published: 2019-05-10
Description: An issue was discovered on XiongMai Besder IP20H1 V4.02.R12.00[PII_REDACTED]2[PII_REDACTED]0 cameras. An attacker on the same local network as the camera can craft a message with a size field larger than 0x80000000 and send it to the camera, related to an integer overflow or use of a negative number. This then crashes the camera for about 120 seconds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://blog.0x42424242.in/2019/04/besder-investigative-journey-part-1_24.html; https://www.youtube.com/watch?v=SnyPJtDDMFQ; http://blog.0x42424242.in/2019/04/besder-investigative-journey-part-1_24.html
CVE: CVE-2019-4204
Published: 2019-05-10
Description: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108328; https://exchange.xforce.ibmcloud.com/vulnerabilities/159125; https://www.ibm.com/support/docview.wss?uid=ibm10880499
CVE: CVE-2017-12884
Published: 2019-05-10
Description: OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://app.com; http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE: CVE-2019-11082
Published: 2019-05-10
Description: core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/dkpro/dkpro-core/issues/1325; https://github.com/dkpro/dkpro-core/issues/1325
CVE: CVE-2019-11879
Published: 2019-05-10
Description: The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-59
References: https://bugs.ruby-lang.org/issues/15835; https://bugs.ruby-lang.org/issues/15835
CVE: CVE-2018-7082
Published: 2019-05-10
Description: A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. Workaround: None. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/108374; https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
CVE: CVE-2018-7083
Published: 2019-05-10
Description: If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed. It was discovered that core dumps are stored in a way that unauthenticated users can access them through the Aruba Instant web interface. Core dumps could contain sensitive information such as keys and passwords. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt; http://www.securityfocus.com/bid/108374; https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
CVE: CVE-2018-7064
Published: 2019-05-10
Description: A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to trick an IAP administrator into clicking a link which could then take administrative actions on the Instant cluster, or expose the session cookie for an administrative session. Workaround: Administrators should make sure they log out of the Aruba Instant UI when not actively managing the system, and should use caution clicking links from external sources while logged into the IAP administrative interface. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108374; https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
CVE: CVE-2018-7084
Published: 2019-05-10
Description: A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.securityfocus.com/bid/108374; https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
CVE: CVE-2018-7119
Published: 2019-05-10
Description: A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.
CVSS Score: 7.0 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03910en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03910en_us
CVE: CVE-2018-7120
Published: 2019-05-10
Description: A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Custom SPP 2018.11.20190205, could allow local or remote unauthorized elevation of privilege.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03916en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03916en_us
CVE: CVE-2019-5018
Published: 2019-05-10
Description: An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/152809/Sqlite3-Window-Function-Remote-Code-Execution.html; http://www.securityfocus.com/bid/108294; https://security.gentoo.org/glsa/201908-09
CVE: CVE-2019-5494
Published: 2019-05-10
Description: OnCommand Unified Manager 7-Mode prior to version 5.2.4 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-8812
Published: 2019-05-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-15610. Reason: This candidate is a reservation duplicate of CVE-2018-15610. Notes: All CVE users should reference CVE-2018-15610 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-11000
Published: 2019-05-10
Description: An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/108301; https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-11059
Published: 2019-05-10
Description: Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.denx.de/?p=u-boot.git%3Ba=commit%3Bh=febbc583319b567fe3d83e521cc2ace9be8d1501; https://github.com/u-boot/u-boot/commits/master; https://git.denx.de/?p=u-boot.git%3Ba=commit%3Bh=febbc583319b567fe3d83e521cc2ace9be8d1501
CVE: CVE-2019-11066
Published: 2019-05-10
Description: openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://marc.info/?l=openid-security&m=[PII_REDACTED]5610&w=2; https://marc.info/?l=openid-security&m=[PII_REDACTED]5610&w=2
CVE: CVE-2019-5495
Published: 2019-05-10
Description: OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-5496
Published: 2019-05-10
Description: Oncommand Insight versions prior to 7.3.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-3566
Published: 2019-05-10
Description: A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://www.facebook.com/security/advisories/cve-2019-3566; https://www.facebook.com/security/advisories/cve-2019-3566