deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5913
Published: 2019-06-14
Description: A non-time constant function memcmp is used which creates a side channel that could leak information in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-6339
Published: 2019-06-14
Description: When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://www.facebook.com/security/advisories/cve-2018-6339/; https://www.facebook.com/security/advisories/cve-2018-6339/
CVE: CVE-2018-6349
Published: 2019-06-14
Description: When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/108804; https://www.facebook.com/security/advisories/cve-2018-6349/; http://www.securityfocus.com/bid/108804
CVE: CVE-2018-6350
Published: 2019-06-14
Description: An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/108803; https://www.facebook.com/security/advisories/cve-2018-6350/; http://www.securityfocus.com/bid/108803
CVE: CVE-2019-2255
Published: 2019-06-14
Description: An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2256
Published: 2019-06-14
Description: An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2257
Published: 2019-06-14
Description: Wrong permissions in configuration file can lead to unauthorized permission in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, SD 210/SD 212/SD 205, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 855, SDA660, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2259
Published: 2019-06-14
Description: Resource allocation error while playing the video whose dimensions are more than supported dimension in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-0303
Published: 2019-06-14
Description: SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2637997; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2637997
CVE: CVE-2019-0316
Published: 2019-06-14
Description: SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2745917; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2745917
CVE: CVE-2019-12828
Published: 2019-06-14
Description: An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt plugin remotely via the platformpluginpath argument supplied with a Windows network share.
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: http://packetstormsecurity.com/files/153385/EA-Origin-Remote-Code-Execution.html; https://www.bleepingcomputer.com/news/security/qt5-based-gui-apps-susceptible-to-remote-code-execution/; https://www.youtube.com/watch?v=E9vCx9KsF3c
CVE: CVE-2019-9842
Published: 2019-06-14
Description: madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/madskristensen/MiniBlog/blob/1a7ae45ddba484e2c8f808e288e018748c9ddb57/Website/app_code/handlers/PostHandler.cs#L85; https://rastating.github.io/miniblog-remote-code-execution/; https://github.com/madskristensen/MiniBlog/blob/1a7ae45ddba484e2c8f808e288e018748c9ddb57/Website/app_code/handlers/PostHandler.cs#L85
CVE: CVE-2019-12816
Published: 2019-06-15
Description: Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00018.html; https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311
CVE: CVE-2019-12829
Published: 2019-06-15
Description: radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/radare/radare2/issues/14303; https://github.com/radare/radare2/issues/14303
CVE: CVE-2019-12830
Published: 2019-06-15
Description: In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/; https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/; https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/
CVE: CVE-2019-12831
Published: 2019-06-15
Description: In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/; https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/; https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/
CVE: CVE-2019-12835
Published: 2019-06-15
Description: formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/JayXon/Leanify/issues/52; https://github.com/JayXon/Leanify/issues/52
CVE: CVE-2019-12839
Published: 2019-06-15
Description: In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://ctrsec.io/index.php/2019/06/11/ace-orangehrm/; https://github.com/orangehrm/orangehrm/pull/528; https://ctrsec.io/index.php/2019/06/11/ace-orangehrm/
CVE: CVE-2019-12840
Published: 2019-06-15
Description: In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html; http://www.securityfocus.com/bid/108790; https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html
CVE: CVE-2013-7472
Published: 2019-06-15
Description: The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.openwall.net/full-disclosure/2013/03/05/2; https://wordpress.org/plugins/count-per-day/#developers; https://lists.openwall.net/full-disclosure/2013/03/05/2
CVE: CVE-2019-12855
Published: 2019-06-16
Description: In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html; https://github.com/twisted/twisted/pull/1147
CVE: CVE-2018-20468
Published: 2019-06-17
Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://barriersec.com/2019/06/cve-2018-20468-sahi-pro/; https://barriersec.com/2019/06/cve-2018-20468-sahi-pro/
CVE: CVE-2018-20469
Published: 2019-06-17
Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html; https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/; http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html
CVE: CVE-2018-20470
Published: 2019-06-17
Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html; https://barriersec.com/2019/06/cve-2018-20470-sahi-pro/; http://packetstormsecurity.com/files/153330/Sahi-Pro-7.x-8.x-Directory-Traversal.html
CVE: CVE-2018-20472
Published: 2019-06-17
Description: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153332/Sahi-Pro-8.x-Cross-Site-Scripting.html; https://barriersec.com/2019/06/cve-2018-20472-sahi-pro/; http://packetstormsecurity.com/files/153332/Sahi-Pro-8.x-Cross-Site-Scripting.html
CVE: CVE-2018-10239
Published: 2019-06-17
Description: A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the "support access" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the "support access" feature is enabled, they know the support access code for the current session, and they know the algorithm to generate the support access password from the support access code. "Support access" is disabled by default. When enabled, the access will be automatically disabled (and support access code will expire) after the 24 hours.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309; https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309
CVE: CVE-2018-1845
Published: 2019-06-17
Description: IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/150905; https://www.ibm.com/support/docview.wss?uid=ibm10738917; https://exchange.xforce.ibmcloud.com/vulnerabilities/150905
CVE: CVE-2019-4103
Published: 2019-06-17
Description: IBM Tivoli Netcool/Impact 7.1.0 allows for remote execution of command by low privileged User. Remote code execution allow to execute arbitrary code on system which lead to take control over the system. IBM X-Force ID: 158094.
CVSS Score: 8.0 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158094; https://www.ibm.com/support/docview.wss?uid=ibm10887523; https://exchange.xforce.ibmcloud.com/vulnerabilities/158094
CVE: CVE-2019-4136
Published: 2019-06-17
Description: IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158332.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10886913; https://exchange.xforce.ibmcloud.com/vulnerabilities/158332; http://www.ibm.com/support/docview.wss?uid=ibm10886913
CVE: CVE-2019-4173
Published: 2019-06-17
Description: IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10886913; https://exchange.xforce.ibmcloud.com/vulnerabilities/158878; http://www.ibm.com/support/docview.wss?uid=ibm10886913
CVE: CVE-2019-4174
Published: 2019-06-17
Description: IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158879.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: http://www.ibm.com/support/docview.wss?uid=ibm10886913; https://exchange.xforce.ibmcloud.com/vulnerabilities/158879; http://www.ibm.com/support/docview.wss?uid=ibm10886913
CVE: CVE-2019-4176
Published: 2019-06-17
Description: IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to insecure HTTP Methods. An attacker could exploit this vulnerability to gain access to the system. IBM X-Force ID: 158881.
CVSS Score: 5.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10886913; https://exchange.xforce.ibmcloud.com/vulnerabilities/158881; http://www.ibm.com/support/docview.wss?uid=ibm10886913
CVE: CVE-2019-4177
Published: 2019-06-17
Description: IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158882.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: http://www.ibm.com/support/docview.wss?uid=ibm10886913; https://exchange.xforce.ibmcloud.com/vulnerabilities/158882; http://www.ibm.com/support/docview.wss?uid=ibm10886913
CVE: CVE-2019-12181
Published: 2019-06-17
Description: A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153333/Serv-U-FTP-Server-15.1.6-Privilege-Escalation.html; http://packetstormsecurity.com/files/153505/Serv-U-FTP-Server-prepareinstallation-Privilege-Escalation.html; https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html
CVE: CVE-2019-6323
Published: 2019-06-17
Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/us-en/document/c06356322; https://support.hp.com/us-en/document/c06356322
CVE: CVE-2019-6324
Published: 2019-06-17
Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/us-en/document/c06356322; https://support.hp.com/us-en/document/c06356322
CVE: CVE-2019-6325
Published: 2019-06-17
Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.hp.com/us-en/document/c06356322; https://support.hp.com/us-en/document/c06356322
CVE: CVE-2019-6326
Published: 2019-06-17
Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: https://support.hp.com/us-en/document/c06356322; https://support.hp.com/us-en/document/c06356322
CVE: CVE-2019-6327
Published: 2019-06-17
Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an IPP Parser potentially vulnerable to Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.hp.com/us-en/document/c06356322; https://support.hp.com/us-en/document/c06356322
CVE: CVE-2017-9388
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific request to and from from another website. This is primarily used as a method of communication between the device and Vera website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the device and website. One of the parameters retrieved by this specific script is "url". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute "curl" functionality. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8