deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6814
Published: 2019-05-22
Description: A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://www.se.com/ww/en/download/document/SEVD-2019-134-01/; https://www.se.com/ww/en/download/document/SEVD-2019-134-01/
CVE: CVE-2019-6815
Published: 2019-05-22
Description: In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol.
CVSS Score: 9.1 (CRITICAL)
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-09/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-09/
CVE: CVE-2019-6816
Published: 2019-05-22
Description: In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-09/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-09/
CVE: CVE-2019-6819
Published: 2019-05-22
Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: http://www.securityfocus.com/bid/109004; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/; http://www.securityfocus.com/bid/109004
CVE: CVE-2019-6820
Published: 2019-05-22
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
CVSS Score: 8.2 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-02/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-02/
CVE: CVE-2019-6821
Published: 2019-05-22
Description: CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330, CWE-330
References: http://www.securityfocus.com/bid/108366; https://ics-cert.us-cert.gov/advisories/ICSA-19-136-01; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-03/
CVE: CVE-2018-7201
Published: 2019-05-22
Description: CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://www.projectsend.org/change-log-detail/r1053/; https://www.projectsend.org/change-log-detail/r1053/
CVE: CVE-2018-7803
Published: 2019-05-22
Description: A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack only while running in off-line mode. This vulnerability does not exist in Triconex hardware products and therefore has no effect on the operating safety functions in a plant.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-03; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-03
CVE: CVE-2018-7844
Published: 2019-05-22
Description: A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0739; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7853
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0764; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7854
Published: 2019-05-22
Description: A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0765; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7855
Published: 2019-05-22
Description: A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0766; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0767
CVE: CVE-2018-7856
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0767; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7857
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0768; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2019-6806
Published: 2019-05-22
Description: A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.
CVSS Score: 7.5 (HIGH)
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0769; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2019-6807
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0770; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2019-6808
Published: 2019-05-22
Description: A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0771; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2019-12293
Published: 2019-05-23
Description: In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108457; https://access.redhat.com/errata/RHSA-2019:2713; https://gitlab.freedesktop.org/poppler/poppler/issues/768
CVE: CVE-2019-12295
Published: 2019-05-23
Description: In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://www.securityfocus.com/bid/108464; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820
CVE: CVE-2019-11873
Published: 2019-05-23
Description: wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length, client hello length, total extensions length, PSK extension length, total identity length, and identity length contain their maximum value which is 2^16. The identity data field of the PSK extension of the packet contains the attack data, to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Possibly the attacker can perform a remote code execution attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/108466; https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842; https://www.telekom.com/resource/blob/572524/1c89c1cbaccdf792153063b3a10af10e/dl-190515-remote-buffer-overflow-vulnerability-wolfssl-library-data.pdf
CVE: CVE-2018-15664
Published: 2019-05-23
Description: In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html; http://www.openwall.com/lists/oss-security/2019/05/28/1
CVE: CVE-2019-0201
Published: 2019-05-23
Description: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/108427; https://access.redhat.com/errata/RHSA-2019:3140; https://access.redhat.com/errata/RHSA-2019:3892
CVE: CVE-2019-10977
Published: 2019-05-23
Description: In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP service, forcing the target devices to enter an error mode and cause a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-755
References: http://www.securityfocus.com/bid/108419; https://ics-cert.us-cert.gov/advisories/ICSA-19-141-02; http://www.securityfocus.com/bid/108419
CVE: CVE-2019-12042
Published: 2019-05-23
Description: Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://github.com/SouhailHammou/Panda-Antivirus-LPE; https://rce4fun.blogspot.com/2019/05/panda-antivirus-local-privilege.html; https://www.pandasecurity.com/usa/support/card?id=100063
CVE: CVE-2019-12297
Published: 2019-05-23
Description: An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter_fmtVuln.md; https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter_fmtVuln.md
CVE: CVE-2019-12298
Published: 2019-05-23
Description: Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/JayXon/Leanify/issues/50; https://github.com/JayXon/Leanify/issues/50
CVE: CVE-2019-4039
Published: 2019-05-23
Description: IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting system. IBM X-Force ID: 156163.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156163; https://www.ibm.com/support/docview.wss?uid=ibm10870492; https://exchange.xforce.ibmcloud.com/vulnerabilities/156163
CVE: CVE-2019-4078
Published: 2019-05-23
Description: IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157190; https://www.ibm.com/support/docview.wss?uid=ibm10872876; https://exchange.xforce.ibmcloud.com/vulnerabilities/157190
CVE: CVE-2019-9949
Published: 2019-05-23
Description: Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://bnbdr.github.io/posts/wd/; https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-183-05-20-2019/237717; https://github.com/bnbdr/wd-rce/
CVE: CVE-2017-15029
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE: CVE-2017-15030
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE: CVE-2017-15652
Published: 2019-05-23
Description: Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=2fc463d0e; http://www.securityfocus.com/bid/108463; https://bugs.ghostscript.com/show_bug.cgi?id=698676
CVE: CVE-2017-17060
Published: 2019-05-23
Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-275
References: http://ox.com; https://documentation.open-xchange.com/components/releasenotes/7.8.3/; http://ox.com
CVE: CVE-2017-17061
Published: 2019-05-23
Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://ox.com; https://documentation.open-xchange.com/components/releasenotes/7.8.3/; http://ox.com
CVE: CVE-2017-5210
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2017-5211
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2017-5212
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2017-5213
Published: 2019-05-23
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2019-12272
Published: 2019-05-23
Description: In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/openwrt/luci/commit/9e4b8a91384562e3baee724a52b72e30b1aa006d; https://github.com/openwrt/luci/commits/master; https://github.com/openwrt/luci/commit/9e4b8a91384562e3baee724a52b72e30b1aa006d
CVE: CVE-2019-12300
Published: 2019-05-23
Description: Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA/
CVE: CVE-2017-11561
Published: 2019-05-23
Description: An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://manageengine.com; http://opmanager.com; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18736
CVE: CVE-2017-11738
Published: 2019-05-23
Description: In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://application.com; http://manageengine.com; http://www.securityfocus.com/bid/108470
CVE: CVE-2017-11739
Published: 2019-05-23
Description: In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a "Utility Widget" that contains malicious JavaScript code, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://application.com; http://manageengine.com; http://www.securityfocus.com/bid/108469
CVE: CVE-2017-11740
Published: 2019-05-23
Description: In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://application.com; http://manageengine.com; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18734
CVE: CVE-2017-13668
Published: 2019-05-23
Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html; http://ox.com
CVE: CVE-2019-12301
Published: 2019-05-23
Description: The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.
CVSS Score: 9.8 (CRITICAL)
References: https://jira.percona.com/browse/PS-5640; https://www.percona.com/blog/2019/05/17/percona-server-for-mysql-5-6-44-85-0-is-now-available/; https://jira.percona.com/browse/PS-5640
CVE: CVE-2019-7097
Published: 2019-05-23
Description: Adobe Dreamweaver versions 19.0 and earlier have an insecure protocol implementation vulnerability. Successful exploitation could lead to sensitive data disclosure if smb request is subject to a relay attack.
CVSS Score: 7.5 (HIGH)
References: https://helpx.adobe.com/security/products/dreamweaver/apsb19-21.html; https://helpx.adobe.com/security/products/dreamweaver/apsb19-21.html