deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11368
Published: 2019-06-03
Description: Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/open?id=1X42Rdb_u4YVieXRqs0jOjyJZOb7DCJT6; https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11368; https://drive.google.com/open?id=1X42Rdb_u4YVieXRqs0jOjyJZOb7DCJT6
CVE: CVE-2019-12097
Published: 2019-06-03
Description: Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of EnableLoopback.exe before running it, which could lead to code execution or local privilege escalation by replacing the original EnableLoopback.exe.
CVSS Score: 7.8 (HIGH)
CWE: CWE-354
References: https://vuldb.com/?id.135671; https://vuldb.com/?id.135671
CVE: CVE-2019-12548
Published: 2019-06-03
Description: Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/bludit/bludit/commit/d0843a4070c7d7fa596a7eb2130be[PII_REDACTED]; https://github.com/bludit/bludit/compare/5e5957c...77e85e7; https://github.com/bludit/bludit/releases/tag/3.9.0
CVE: CVE-2019-9824
Published: 2019-06-03
Description: tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://access.redhat.com/errata/RHSA-2019:1650; https://access.redhat.com/errata/RHSA-2019:2078; https://access.redhat.com/errata/RHSA-2019:2425
CVE: CVE-2019-9838
Published: 2019-06-03
Description: VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153104/VFront-0.99.5-Persistent-Cross-Site-Scripting.html; https://www.netsparker.com/web-applications-advisories/; http://packetstormsecurity.com/files/153104/VFront-0.99.5-Persistent-Cross-Site-Scripting.html
CVE: CVE-2019-9839
Published: 2019-06-03
Description: VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153103/VFront-0.99.5-Reflective-Cross-Site-Scripting.html; https://www.netsparker.com/web-applications-advisories/; http://packetstormsecurity.com/files/153103/VFront-0.99.5-Reflective-Cross-Site-Scripting.html
CVE: CVE-2019-12614
Published: 2019-06-03
Description: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html; http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
CVE: CVE-2019-12615
Published: 2019-06-03
Description: An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/108549; https://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc.git/commit/?id=80caf43549e7e41a695c6d1e[PII_REDACTED]b336f; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-12727
Published: 2019-06-04
Description: On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The issue can be triggered via malformed RTSP requests that lead to an invalid memory read. To exploit the vulnerability, an attacker must craft an RTSP request with a large number of headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/X-C3LL/PoC-CVEs/blob/master/Aircam-DoS/Aircam-DoS.py; https://github.com/X-C3LL/PoC-CVEs/blob/master/Aircam-DoS/Aircam-DoS.py
CVE: CVE-2019-12728
Published: 2019-06-04
Description: Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: https://github.com/grails/grails-core/issues/11250; https://objectcomputing.com/news/2019/05/30/possible-grails-mitm-vulnerability; https://github.com/grails/grails-core/issues/11250
CVE: CVE-2019-12730
Published: 2019-06-04
Description: aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: http://www.securityfocus.com/bid/109317; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2; https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4
CVE: CVE-2019-5244
Published: 2019-06-04
Description: Mate 9 Pro Huawei smartphones earlier than LON-L29C 8.0.0.361(C636) versions have an information leak vulnerability due to the lack of input validation. An attacker tricks the user who has root privilege to install an application on the smart phone, and the application can read some process information, which may cause sensitive information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-informationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-informationleak-en
CVE: CVE-2019-5281
Published: 2019-06-04
Description: There is an information leak vulnerability in some Huawei phones, versions earlier than Jackman-L21 8.2.0.155(C185R1P2). When a local attacker uses the camera of a smartphone, the attacker can exploit this vulnerability to obtain sensitive information by performing a series of operations.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190218-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190218-01-smartphone-en
CVE: CVE-2019-5296
Published: 2019-06-04
Description: Mate20 Huawei smartphones versions earlier than HMA-AL00C00B175 have an out-of-bounds read vulnerability. An attacker with a high permission runs some specific commands on the smartphone. Due to insufficient input verification, successful exploit may cause out-of-bounds read of the memory and the system abnormal.
CVSS Score: 3.9 (LOW)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-phone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-phone-en
CVE: CVE-2019-5306
Published: 2019-06-04
Description: There is a Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions before Emily-AL00A 9.0.0.167(C00E81R1P21T8). When re-configuring the mobile phone using the FRP function, an attacker can delete the activation lock after a series of operations. As a result, the FRP function is bypassed and the attacker gains access to the smartphone.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190228-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190228-01-smartphone-en
CVE: CVE-2019-5215
Published: 2019-06-04
Description: There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), and P30 Pro versions before VOG-AL00 9.1.0.162 (C01E160R1P12/C01E160R2P1). When users establish connection and transfer data through Huawei Share, an attacker could sniff, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attack to obtain and tamper the data. (Vulnerability ID: HWPSIRT-2019-03109)
CVSS Score: 6.8 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190517-01-share-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190517-01-share-en
CVE: CVE-2019-5217
Published: 2019-06-04
Description: There is an information disclosure vulnerability on Mate 9 Pro Huawei smartphones versions earlier than LON-AL00B9.0.1.150 (C00E61R1P8T8). An attacker could view the photos after a series of operations without unlocking the screen lock. Successful exploit could cause an information disclosure condition.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-307
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190417-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190417-01-smartphone-en
CVE: CVE-2019-5283
Published: 2019-06-04
Description: There is Factory Reset Protection (FRP) bypass security vulnerability in P20 Huawei smart phones versions earlier than Emily-AL00A 9.0.0.167 (C00E81R1P21T8). When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the Talkback mode and can perform some operations to access the setting page. As a result, the FRP function is bypassed.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190424-01-frp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190424-01-frp-en
CVE: CVE-2019-5284
Published: 2019-06-04
Description: There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8). Remote attackers could trick the user into opening a malformed RTSP media stream to exploit this vulnerability. Successful exploit could cause the affected phone abnormal, leading to a DoS condition. (Vulnerability ID: HWPSIRT-2019-02004)
CVSS Score: 6.5 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190523-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190523-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190523-01-smartphone-en
CVE: CVE-2019-5285
Published: 2019-06-04
Description: Some Huawei S series switches have a DoS vulnerability. An unauthenticated remote attacker can send crafted packets to the affected device to exploit this vulnerability. Due to insufficient verification of the packets, successful exploitation may cause the device reboot and denial of service (DoS) condition. (Vulnerability ID: HWPSIRT-2019-03109)
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190522-01-switch-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190522-01-switch-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190522-01-switch-en
CVE: CVE-2019-5297
Published: 2019-06-04
Description: Emily-L29C Huawei phones versions earlier than 9.0.0.159 (C185E2R1P12T8) have a Factory Reset Protection (FRP) bypass security vulnerability. Before the FRP account is verified and activated during the reset process, the attacker can perform some special operations to bypass the FRP function and obtain the right to use the mobile phone.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190305-01-frp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190305-01-frp-en
CVE: CVE-2019-5298
Published: 2019-06-04
Description: There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentication for the serial port, an attacker could exploit this vulnerability by connecting to the affected products and running a series of commands.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190327-01-ap-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190327-01-ap-en
CVE: CVE-2019-5300
Published: 2019-06-04
Description: There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-en
CVE: CVE-2019-5307
Published: 2019-06-04
Description: Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), are exposed to a message replay vulnerability. For the sake of better compatibility, these devices implement a less strict check on the NAS message sequence number (SN), specifically NAS COUNT. As a result, an attacker can construct a rogue base station and replay the GUTI reallocation command message in certain conditions to tamper with GUTIs, or replay the Identity request message to obtain IMSIs. (Vulnerability ID: HWPSIRT-2019-04107)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-294
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-replay-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-replay-en
CVE: CVE-2018-13379
Published: 2019-06-04
Description: An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://fortiguard.com/advisory/FG-IR-18-384; https://www.fortiguard.com/psirt/FG-IR-20-233; https://fortiguard.com/advisory/FG-IR-18-384
CVE: CVE-2018-13380
Published: 2019-06-04
Description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-18-383; https://fortiguard.com/advisory/FG-IR-20-230; https://fortiguard.com/advisory/FG-IR-18-383
CVE: CVE-2018-13381
Published: 2019-06-04
Description: A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message payloads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: https://fortiguard.com/advisory/FG-IR-18-387; https://fortiguard.com/advisory/FG-IR-20-232; https://fortiguard.com/advisory/FG-IR-18-387
CVE: CVE-2018-13382
Published: 2019-06-04
Description: An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://fortiguard.com/advisory/FG-IR-18-389; https://www.fortiguard.com/psirt/FG-IR-20-231; https://fortiguard.com/advisory/FG-IR-18-389
CVE: CVE-2018-13384
Published: 2019-06-04
Description: A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HTTP cache and subsequently redirect SSL VPN web portal users to arbitrary web domains.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://fortiguard.com/advisory/FG-IR-19-002; https://fortiguard.com/advisory/FG-IR-19-002
CVE: CVE-2019-10636
Published: 2019-06-04
Description: Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices allow reprogramming flash memory to bypass the secure boot protection mechanism.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-400
References: https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/; https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/
CVE: CVE-2019-12209
Published: 2019-06-04
Description: Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html; http://www.openwall.com/lists/oss-security/2019/06/05/1
CVE: CVE-2019-12210
Published: 2019-06-04
Description: In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
CVSS Score: 8.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html; http://www.openwall.com/lists/oss-security/2019/06/05/1
CVE: CVE-2019-5586
Published: 2019-06-04
Description: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108610; https://fortiguard.com/advisory/FG-IR-19-034; http://www.securityfocus.com/bid/108610
CVE: CVE-2019-5587
Published: 2019-06-04
Description: Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassembling the image through specific methods.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: http://www.securityfocus.com/bid/108628; https://fortiguard.com/advisory/FG-IR-19-017; http://www.securityfocus.com/bid/108628
CVE: CVE-2019-5588
Published: 2019-06-04
Description: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108618; https://fortiguard.com/advisory/FG-IR-19-034; http://www.securityfocus.com/bid/108618
CVE: CVE-2019-11768
Published: 2019-06-05
Description: An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html; http://www.securityfocus.com/bid/108617
CVE: CVE-2019-12616
Published: 2019-06-05
Description: An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html; http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html
CVE: CVE-2017-6261
Published: 2019-06-05
Description: NVIDIA Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to denial of service or information disclosure.
CVSS Score: 8.2 (HIGH)
CWE: CWE-693, CWE-20
References: https://data.hackinn.com/ppt/BlackHat-USA-2018/us-18-Liu-Over-The-Air-How-We-Remotely-Compromised-The-Gateway-Bcm-And-Autopilot-Ecus-Of-Tesla-Cars-wp.pdf; https://data.hackinn.com/ppt/BlackHat-USA-2018/us-18-Liu-Over-The-Air-How-We-Remotely-Compromised-The-Gateway-Bcm-And-Autopilot-Ecus-Of-Tesla-Cars-wp.pdf
CVE: CVE-2019-10149
Published: 2019-06-05
Description: A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html; http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html; http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
CVE: CVE-2019-12735
Published: 2019-06-05
Description: getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
CVE: CVE-2019-12739
Published: 2019-06-05
Description: lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://hackerone.com/reports/546753; https://www.secsignal.org/news/a-tale-of-rce-nextcloud-extract-app/; https://hackerone.com/reports/546753
CVE: CVE-2018-18571
Published: 2019-06-05
Description: An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch 3. An attacker can impersonate and take actions on behalf of any Mobile Application Management (MAM) enrolled device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/108081; https://support.citrix.com/article/CTX247736; http://www.securityfocus.com/bid/108081
CVE: CVE-2018-7121
Published: 2019-06-05
Description: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us