deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-3412
Published: 2019-06-11
Description: All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters, an attacker can execute arbitrary commands through specific interfaces.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010686; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010686
CVE: CVE-2019-3413
Published: 2019-06-11
Description: All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applications, which results in users being hijacked.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010797; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010797
CVE: CVE-2009-5156
Published: 2019-06-11
Description: An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.securityfocus.com/archive/1/503946; https://www.securityfocus.com/bid/35153; https://www.securityfocus.com/archive/1/503946
CVE: CVE-2009-5157
Published: 2019-06-11
Description: On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.securityfocus.com/archive/1/503934; https://www.securityfocus.com/bid/35142; https://www.securityfocus.com/archive/1/503934
CVE: CVE-2010-5330
Published: 2019-06-11
Description: On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974; https://www.exploit-db.com/exploits/14146; https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974
CVE: CVE-2013-7471
Published: 2019-06-11
Description: An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.s3cur1ty.de/m1adv2013-020; https://www.exploit-db.com/exploits/27044; http://www.s3cur1ty.de/m1adv2013-020
CVE: CVE-2016-10760
Published: 2019-06-11
Description: On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://ethical-hacker.org/en/seowonintech-remote-root/; https://ethical-hacker.org/en/seowonintech-remote-root/
CVE: CVE-2017-18377
Published: 2019-06-11
Description: An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-root-rce; https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-root-rce
CVE: CVE-2017-18378
Published: 2019-06-11
Description: In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_dir, leading to upgrade_handle.php?cmd=writeuploaddir remote command execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-ReadyNAS-Surveillance-Application-PSV-2017-2653; https://www.exploit-db.com/exploits/42956; https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-ReadyNAS-Surveillance-Application-PSV-2017-2653
CVE: CVE-2018-20841
Published: 2019-06-11
Description: HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mac_table request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://ioactive.com/hootoo-tripmate-routers-are-cute-but/; https://www.exploit-db.com/exploits/46143; https://ioactive.com/hootoo-tripmate-routers-are-cute-but/
CVE: CVE-2019-0220
Published: 2019-06-11
Description: A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-706
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
CVE: CVE-2019-12143
Published: 2019-06-11
Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WS_FTP usernames as well as filenames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm; https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE: CVE-2019-12144
Published: 2019-06-11
Description: An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm; https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE: CVE-2019-12145
Published: 2019-06-11
Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm; https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE: CVE-2019-12146
Published: 2019-06-11
Description: A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm; https://docs.ipswitch.com/WS_FTP_Server2018/ReleaseNotes/index.htm#49242.htm
CVE: CVE-2019-12153
Published: 2019-06-11
Description: Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html; https://www.pdfreactor.com/important-pdfreactor-security-advisory/; https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/
CVE: CVE-2019-12154
Published: 2019-06-11
Description: XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://blog.gdssecurity.com/labs/2019/5/28/ssrf-and-xxe-vulnerabilities-in-pdfreactor.html; https://www.pdfreactor.com/important-pdfreactor-security-advisory/; https://www.pdfreactor.com/pdfreactor-10-maintenance-release-10-1-10722-now-available/
CVE: CVE-2019-0196
Published: 2019-06-11
Description: A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
CVE: CVE-2019-0197
Published: 2019-06-11
Description: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
CVE: CVE-2019-12149
Published: 2019-06-11
Description: SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.silverstripe.org/download/security-releases/cve-2019-12149; https://www.silverstripe.org/download/security-releases/cve-2019-12149
CVE: CVE-2019-12795
Published: 2019-06-11
Description: daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html; http://www.securityfocus.com/bid/108741
CVE: CVE-2017-15123
Published: 2019-06-12
Description: A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/108690; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123; https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/
CVE: CVE-2019-0620
Published: 2019-06-12
Description: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.
An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.
The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0620; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0620
CVE: CVE-2019-0709
Published: 2019-06-12
Description: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.
An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.
The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0709; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0709
CVE: CVE-2019-0710
Published: 2019-06-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.
The security update addresses the vulnerability by resolving a number of conditions where Hyper-V would fail to prevent a guest operating system from sending malicious requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0710; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0710
CVE: CVE-2019-0711
Published: 2019-06-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.
The security update addresses the vulnerability by resolving a number of conditions where Hyper-V would fail to prevent a guest operating system from sending malicious requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0711; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0711
CVE: CVE-2019-0713
Published: 2019-06-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.
The security update addresses the vulnerability by resolving a number of conditions where Hyper-V would fail to prevent a guest operating system from sending malicious requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0713; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0713
CVE: CVE-2019-0722
Published: 2019-06-12
Description: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.
An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.
The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0722; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0722
CVE: CVE-2019-0888
Published: 2019-06-12
Description: A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges.
An attacker could craft a website that exploits the vulnerability and then convince a victim user to visit the website.
The security update addresses the vulnerability by modifying how ActiveX Data Objects handle objects in memory.
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0888; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0888
CVE: CVE-2019-0904
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0904; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0904
CVE: CVE-2019-0905
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0905; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0905
CVE: CVE-2019-0906
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0906; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0906; https://www.zerodayinitiative.com/advisories/ZDI-19-624/
CVE: CVE-2019-0907
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0907; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0907
CVE: CVE-2019-0908
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0908; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0908
CVE: CVE-2019-0909
Published: 2019-06-12
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0909; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0909
CVE: CVE-2019-0920
Published: 2019-06-12
Description: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit the vulnerability through a Microsoft browser and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the browser rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787, CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0920; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0920; https://www.zerodayinitiative.com/advisories/ZDI-19-625/