deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-3753
Published: 2019-08-20
Description: Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://www.dell.com/support/article/sln318359/; https://www.dell.com/support/article/sln318359/
CVE: CVE-2019-3968
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2019-4049
Published: 2019-08-20
Description: IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156398; https://www.ibm.com/support/docview.wss?uid=ibm10870490; https://exchange.xforce.ibmcloud.com/vulnerabilities/156398
CVE: CVE-2019-4117
Published: 2019-08-20
Description: IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=ibm10878396; https://exchange.xforce.ibmcloud.com/vulnerabilities/158116; http://www.ibm.com/support/docview.wss?uid=ibm10878396
CVE: CVE-2019-4253
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local privileged Informix user to load a malicious shared library and gain root access privileges. IBM X-Force ID: 159941.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/159941; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-4294
Published: 2019-08-20
Description: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160701; https://www.ibm.com/support/docview.wss?uid=ibm10887005; https://www.ibm.com/support/docview.wss?uid=ibm10958933
CVE: CVE-2019-4308
Published: 2019-08-20
Description: IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161034; https://www.ibm.com/support/docview.wss?uid=ibm10880221; https://exchange.xforce.ibmcloud.com/vulnerabilities/161034
CVE: CVE-2019-4310
Published: 2019-08-20
Description: IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161036; https://www.ibm.com/support/docview.wss?uid=ibm10960298; https://exchange.xforce.ibmcloud.com/vulnerabilities/161036
CVE: CVE-2019-4402
Published: 2019-08-20
Description: IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID: 162263.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162263; https://www.ibm.com/support/docview.wss?uid=ibm10958193; https://exchange.xforce.ibmcloud.com/vulnerabilities/162263
CVE: CVE-2019-4419
Published: 2019-08-20
Description: IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162737; https://www.ibm.com/support/docview.wss?uid=ibm10956433; https://exchange.xforce.ibmcloud.com/vulnerabilities/162737
CVE: CVE-2019-4420
Published: 2019-08-20
Description: IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162738; https://www.ibm.com/support/docview.wss?uid=ibm10956429; https://exchange.xforce.ibmcloud.com/vulnerabilities/162738
CVE: CVE-2019-4425
Published: 2019-08-20
Description: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
CVSS Score: 5.7 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162771; https://www.ibm.com/support/docview.wss?uid=ibm10959261; https://exchange.xforce.ibmcloud.com/vulnerabilities/162771
CVE: CVE-2019-4433
Published: 2019-08-20
Description: IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162890.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162890; https://www.ibm.com/support/docview.wss?uid=ibm10958079; https://www.ibm.com/support/docview.wss?uid=ibm10958081
CVE: CVE-2019-4460
Published: 2019-08-20
Description: IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 163681.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163681; https://www.ibm.com/support/docview.wss?uid=ibm10960848; https://exchange.xforce.ibmcloud.com/vulnerabilities/163681
CVE: CVE-2019-4481
Published: 2019-08-20
Description: IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164064.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164064; https://www.ibm.com/support/docview.wss?uid=ibm10880223; https://exchange.xforce.ibmcloud.com/vulnerabilities/164064
CVE: CVE-2019-4483
Published: 2019-08-20
Description: IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164067.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164067; https://www.ibm.com/support/docview.wss?uid=ibm10880223; https://exchange.xforce.ibmcloud.com/vulnerabilities/164067
CVE: CVE-2019-4484
Published: 2019-08-20
Description: IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164068; https://www.ibm.com/support/docview.wss?uid=ibm10880221; https://exchange.xforce.ibmcloud.com/vulnerabilities/164068
CVE: CVE-2019-4485
Published: 2019-08-20
Description: IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164069; https://www.ibm.com/support/docview.wss?uid=ibm10880221; https://exchange.xforce.ibmcloud.com/vulnerabilities/164069
CVE: CVE-2019-7593
Published: 2019-08-20
Description: Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-323, CWE-798
References: https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf; https://www.us-cert.gov/ics/advisories/icsa-19-227-01; https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf
CVE: CVE-2019-7594
Published: 2019-08-20
Description: Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf; https://www.us-cert.gov/ics/advisories/icsa-19-227-01; https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2019/jci-psa-2019-06-v1-metasys-icsa-19-227-01.pdf
CVE: CVE-2019-11924
Published: 2019-08-20
Description: A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/facebookincubator/fizz/commit/3eaddb33619eaaf74a760872850c550ad8f5c52f; https://github.com/facebookincubator/fizz/commit/6bf67137ef1ee5cd70c842b014c322b7deaf994b; https://www.facebook.com/security/advisories/cve-2019-11924
CVE: CVE-2019-13520
Published: 2019-08-20
Description: Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-227-02; https://www.zerodayinitiative.com/advisories/ZDI-19-798/; https://www.zerodayinitiative.com/advisories/ZDI-19-820/
CVE: CVE-2019-2120
Published: 2019-08-20
Description: In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130821293.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2121
Published: 2019-08-20
Description: In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-131105245.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2122
Published: 2019-08-20
Description: In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127605586.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2125
Published: 2019-08-20
Description: In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no additional privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132275252.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2126
Published: 2019-08-20
Description: In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQSTK442ATWJOR4TU3MR6C3N5A6NDFFN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2IIA3RSYABBUCFIHXIRVUT5CTJVWWZ6/
CVE: CVE-2019-2127
Published: 2019-08-20
Description: In AudioInputDescriptor::setClientActive of AudioInputDescriptor.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124899895.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2128
Published: 2019-08-20
Description: In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132647222.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2129
Published: 2019-08-20
Description: In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124781927.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2130
Published: 2019-08-20
Description: In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132073833.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2131
Published: 2019-08-20
Description: An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-119115683.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2132
Published: 2019-08-20
Description: It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130568701.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2133
Published: 2019-08-20
Description: In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132082342.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2134
Published: 2019-08-20
Description: In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132083376.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2135
Published: 2019-08-20
Description: In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-125900276.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2136
Published: 2019-08-20
Description: In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-2137
Published: 2019-08-20
Description: In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-132438333.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-08-01; https://source.android.com/security/bulletin/2019-08-01
CVE: CVE-2019-4120
Published: 2019-08-20
Description: IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158146.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10885328; https://exchange.xforce.ibmcloud.com/vulnerabilities/158146; http://www.ibm.com/support/docview.wss?uid=ibm10885328
CVE: CVE-2019-4167
Published: 2019-08-20
Description: IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=ibm10967327; https://exchange.xforce.ibmcloud.com/vulnerabilities/158700; http://www.ibm.com/support/docview.wss?uid=ibm10967327
CVE: CVE-2019-4338
Published: 2019-08-20
Description: IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161417; https://www.ibm.com/support/docview.wss?uid=ibm10960858; https://exchange.xforce.ibmcloud.com/vulnerabilities/161417
CVE: CVE-2019-4340
Published: 2019-08-20
Description: IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 161419.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161419; https://www.ibm.com/support/docview.wss?uid=ibm10960856; https://exchange.xforce.ibmcloud.com/vulnerabilities/161419