deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1930
Published: 2019-07-06
Description: Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss
CVE: CVE-2019-1931
Published: 2019-07-06
Description: Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss
CVE: CVE-2019-1932
Published: 2019-07-06
Description: A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-amp-commandinj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-amp-commandinj
CVE: CVE-2019-1933
Published: 2019-07-06
Description: A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-filterpass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-filterpass
CVE: CVE-2019-13362
Published: 2019-07-06
Description: Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/michaelrsweet/codedoc/issues/5; https://github.com/michaelrsweet/codedoc/issues/5
CVE: CVE-2019-13370
Published: 2019-07-06
Description: index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ignitedcms/ignitedcms/issues/7; https://github.com/ignitedcms/ignitedcms/issues/7
CVE: CVE-2019-13372
Published: 2019-07-06
Description: /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-287
References: http://packetstormsecurity.com/files/158904/D-Link-Central-WiFi-Manager-CWM-100-Remote-Code-Execution.html; https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117
CVE: CVE-2019-13373
Published: 2019-07-06
Description: An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117; https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/
CVE: CVE-2019-13374
Published: 2019-07-06
Description: A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117; https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/
CVE: CVE-2019-13375
Published: 2019-07-06
Description: A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117; https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/
CVE: CVE-2019-13183
Published: 2019-07-07
Description: Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://discuss.flarum.org/d/20606-flarum-0-1-0-beta-9-released; https://github.com/flarum/core/blob/master/CHANGELOG.md; https://github.com/flarum/core/security/advisories/GHSA-3wjh-93gr-chh6
CVE: CVE-2019-13379
Published: 2019-07-07
Description: On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://jordonlovik.wordpress.com/2019/07/06/roomalert-by-avtech-critical-vulnerability-disclosure/; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010; https://www.youtube.com/watch?v=X1PY7kMFkVg
CVE: CVE-2019-13390
Published: 2019-07-07
Description: In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://www.securityfocus.com/bid/109090; https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html; https://security.gentoo.org/glsa/202003-65
CVE: CVE-2019-13391
Published: 2019-07-07
Description: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/7c2c5ba5b8e3a0b2b82f56c71dfab74ed4006df7; https://github.com/ImageMagick/ImageMagick/issues/1588
CVE: CVE-2019-13398
Published: 2019-07-08
Description: Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://xor.cat/2019/06/19/fortinet-forticam-vulns/; https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE: CVE-2019-13399
Published: 2019-07-08
Description: Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://xor.cat/2019/06/19/fortinet-forticam-vulns/; https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE: CVE-2019-13400
Published: 2019-07-08
Description: Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://xor.cat/2019/06/19/fortinet-forticam-vulns/; https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE: CVE-2019-13401
Published: 2019-07-08
Description: Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://xor.cat/2019/06/19/fortinet-forticam-vulns/; https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE: CVE-2019-13402
Published: 2019-07-08
Description: /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
CVSS Score: 8.8 (HIGH)
CWE: CWE-212
References: https://xor.cat/2019/06/19/fortinet-forticam-vulns/; https://xor.cat/2019/06/19/fortinet-forticam-vulns/
CVE: CVE-2019-13404
Published: 2019-07-08
Description: The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
CVSS Score: 7.8 (HIGH)
CWE: CWE-552
References: https://docs.python.org/2/faq/windows.html; https://docs.python.org/2/faq/windows.html
CVE: CVE-2018-11563
Published: 2019-07-08
Description: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary stylesheet or JavaScript code in a logged in customer's browser in the context of the OTRS customer panel application.
CVSS Score: 4.6 (MEDIUM)
References: https://community.otrs.com/security-advisory-2018-02-security-update-for-otrs-framework/; https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html; https://lists.otrs.org/pipermail/announce/2018/000720.html
CVE: CVE-2019-12171
Published: 2019-07-08
Description: Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-522
References: https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5; https://drive.google.com/open?id=1msz6pb08crPC0VT7s_Z_KTsKm9CbLJEXNsmRwzoNLy8; https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5
CVE: CVE-2019-12174
Published: 2019-07-08
Description: hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me_hide_vpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to escalate privileges, as well as obtain the ability to run any application on the system in the root context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2; https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2
CVE: CVE-2019-13354
Published: 2019-07-08
Description: The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7/; https://github.com/bdmac/strong_password/releases; https://rubygems.org/gems/strong_password/versions
CVE: CVE-2019-13413
Published: 2019-07-08
Description: The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2119248; https://wordpress.org/plugins/rencontre/#developers; https://wpvulndb.com/vulnerabilities/9430
CVE: CVE-2019-13414
Published: 2019-07-08
Description: The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2119248; https://wordpress.org/plugins/rencontre/#developers; https://wpvulndb.com/vulnerabilities/9430
CVE: CVE-2019-10973
Published: 2019-07-08
Description: Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/109001; https://www.us-cert.gov/ics/advisories/icsa-19-183-02; http://www.securityfocus.com/bid/109001
CVE: CVE-2019-2104
Published: 2019-07-08
Description: In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-131356202
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2105
Published: 2019-07-08
Description: In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-116114182.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2106
Published: 2019-07-08
Description: In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130023983.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2107
Published: 2019-07-08
Description: In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/153628/Android-VideoPlayer-ihevcd_parse_pps-Out-Of-Bounds-Write.html; http://seclists.org/fulldisclosure/2019/Jul/18; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2109
Published: 2019-07-08
Description: In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-130651570.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2111
Published: 2019-07-08
Description: In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free. This could lead to remote code execution in the netd server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-122856181.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2112
Published: 2019-07-08
Description: In several functions of alarm.cc, there is possible memory corruption due to a use after free. This could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-117997080.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2113
Published: 2019-07-08
Description: In setup wizard there is a bypass of some checks when wifi connection is skipped. This could lead to factory reset protection bypass with no additional privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-122597079.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2116
Published: 2019-07-08
Description: In save_attr_seq of sdp_discovery.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117105007.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2117
Published: 2019-07-08
Description: In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check. This could lead to local information disclosure about carrier systems with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124107808.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2118
Published: 2019-07-08
Description: In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-130161842.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-2119
Published: 2019-07-08
Description: In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking. This could lead to local information disclosure of protected data with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-131622568.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://source.android.com/security/bulletin/2019-07-01; https://source.android.com/security/bulletin/2019-07-01
CVE: CVE-2019-9629
Published: 2019-07-08
Description: Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.twistlock.com/labs-blog/vulnerabilities-nexus-repository-left-thousands-artifacts-exposed/; https://www.twistlock.com/labs-blog/vulnerabilities-nexus-repository-left-thousands-artifacts-exposed/
CVE: CVE-2019-9630
Published: 2019-07-08
Description: Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://www.twistlock.com/labs-blog/vulnerabilities-nexus-repository-left-thousands-artifacts-exposed/; https://www.twistlock.com/labs-blog/vulnerabilities-nexus-repository-left-thousands-artifacts-exposed/
CVE: CVE-2019-12930
Published: 2019-07-08
Description: A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/wikindx/code/2787; https://sourceforge.net/p/wikindx/code/2788; https://sourceforge.net/p/wikindx/news/2019/07/wikindx-581-released/
CVE: CVE-2019-12923
Published: 2019-07-08
Description: In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.mailenable.com/Premium-ReleaseNotes.txt; https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/; http://www.mailenable.com/Premium-ReleaseNotes.txt