deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5675
Published: 2019-05-10
Description: NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes, which may lead to denial of service, escalation of privileges, or information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-662
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4797; https://nvidia.custhelp.com/app/answers/detail/a_id/4797
CVE: CVE-2019-5676
Published: 2019-05-10
Description: NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), leading to escalation of privileges through code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4797; https://nvidia.custhelp.com/app/answers/detail/a_id/4806; https://nvidia.custhelp.com/app/answers/detail/a_id/4841
CVE: CVE-2019-5677
Published: 2019-05-10
Description: NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DeviceIoControl where the software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4797; https://nvidia.custhelp.com/app/answers/detail/a_id/4797
CVE: CVE-2019-11884
Published: 2019-05-10
Description: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character.
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html
CVE: CVE-2019-5437
Published: 2019-05-10
Description: Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548, CWE-200
References: https://hackerone.com/reports/453820; https://hackerone.com/reports/453820
CVE: CVE-2019-5438
Published: 2019-05-10
Description: Path traversal using symlink in npm harp module versions <= 0.29.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-59
References: https://hackerone.com/reports/530289; https://hackerone.com/reports/530289
CVE: CVE-2019-11885
Published: 2019-05-12
Description: eyeDisk implements the unlock feature by sending a cleartext password. The password can be discovered by sniffing USB traffic or by sending a 06 05 52 41 01 b0 00 00 00 00 00 00 SCSI command.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: https://www.pentestpartners.com/security-blog/eyedisk-hacking-the-unhackable-again/; https://www.pentestpartners.com/security-blog/eyedisk-hacking-the-unhackable-again/
CVE: CVE-2018-20838
Published: 2019-05-13
Description: ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/; https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt; https://wordpress.org/plugins/accelerated-mobile-pages/#developers
CVE: CVE-2019-11886
Published: 2019-05-13
Description: The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/yellow-pencil-visual-theme-customizer/#developers; https://wpvulndb.com/vulnerabilities/9256; https://www.pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability/
CVE: CVE-2019-11888
Published: 2019-05-13
Description: Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://go-review.googlesource.com/c/go/+/176619; https://go-review.googlesource.com/c/go/+/176619
CVE: CVE-2018-12295
Published: 2019-05-13
Description: SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12296
Published: 2019-05-13
Description: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12297
Published: 2019-05-13
Description: Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12298
Published: 2019-05-13
Description: Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12299
Published: 2019-05-13
Description: Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12300
Published: 2019-05-13
Description: Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12301
Published: 2019-05-13
Description: Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12302
Published: 2019-05-13
Description: Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12303
Published: 2019-05-13
Description: Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-12304
Published: 2019-05-13
Description: Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170; https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
CVE: CVE-2018-14710
Published: 2019-05-13
Description: Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8; https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE: CVE-2018-14711
Published: 2019-05-13
Description: Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8; https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE: CVE-2018-14712
Published: 2019-05-13
Description: Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8; https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE: CVE-2018-14713
Published: 2019-05-13
Description: Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-134
References: https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8; https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE: CVE-2018-14714
Published: 2019-05-13
Description: System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parameter.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8; https://blog.securityevaluators.com/asus-routers-overflow-with-vulnerabilities-b111bc1c8eb8
CVE: CVE-2018-15530
Published: 2019-05-13
Description: Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ysec.ch/?p=94; https://ysec.ch/?p=94
CVE: CVE-2018-16623
Published: 2019-05-13
Description: Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16623/blob/master/CVE-2018-16623.pdf; https://github.com/security-breachlock/CVE-2018-16623/blob/master/CVE-2018-16623.pdf
CVE: CVE-2018-16624
Published: 2019-05-13
Description: panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16624/blob/master/CVE-2018-16624.pdf; https://github.com/security-breachlock/CVE-2018-16624/blob/master/CVE-2018-16624.pdf
CVE: CVE-2018-16625
Published: 2019-05-13
Description: index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-provensec/CVE-2018-16625; https://github.com/security-provensec/CVE-2018-16625
CVE: CVE-2018-16626
Published: 2019-05-13
Description: index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-provensec/CVE-2018-16626; https://github.com/security-provensec/CVE-2018-16626
CVE: CVE-2018-16639
Published: 2019-05-13
Description: Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-provensec/CVE-2018-16639; https://github.com/security-provensec/CVE-2018-16639
CVE: CVE-2018-18558
Published: 2019-05-13
Description: An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: https://github.com/espressif/esp-idf/releases; https://www.espressif.com/en/news/Espressif_Product_Security_Advisory_Concerning_Secure_Boot_%28CVE-2018-18558%29; https://github.com/espressif/esp-idf/releases
CVE: CVE-2018-19037
Published: 2019-05-13
Description: On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open, the router lags and becomes unusable to anyone currently using the web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.exploit-db.com/exploits/45776/; https://www.exploit-db.com/exploits/45776/
CVE: CVE-2019-12041
Published: 2019-05-13
Description: lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/jonschlinkert/remarkable/issues/331; https://github.com/jonschlinkert/remarkable/issues/331
CVE: CVE-2012-6652
Published: 2019-05-13
Description: Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://ceriksen.com/2012/07/10/wordpress-a-page-flip-book-plugin-local-file-inclusion-vulnerability/; https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/; https://www.openwall.com/lists/oss-security/2014/07/30/2
CVE: CVE-2018-15128
Published: 2019-05-13
Description: An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-exectuion-vulnerability-group-series.pdf; https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-exectuion-vulnerability-group-series.pdf
CVE: CVE-2018-18524
Published: 2019-05-13
Description: Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://evernote.com/intl/en/security/updates; https://paper.seebug.org/737/; https://evernote.com/intl/en/security/updates
CVE: CVE-2018-18872
Published: 2019-05-13
Description: The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9141; https://wpvulndb.com/vulnerabilities/9141
CVE: CVE-2018-19048
Published: 2019-05-13
Description: Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hkglue/simditor_demo.git; https://github.com/hkglue/simditor_dom_xss/blob/master/README.md; https://github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fd
CVE: CVE-2018-19986
Published: 2019-05-13
Description: In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 202KRb06 devices. In the SetRouterSettings.php source code, the RemotePort parameter is saved in the $path_inf_wan1."/web" internal configuration memory without any regex checking. And in the IPTWAN_build_command function of the iptwan.php source code, the data in $path_inf_wan1."/web" is used with the iptables command without any regex checking. A vulnerable /HNAP1/SetRouterSettings XML message could have shell metacharacters in the RemotePort element such as the `telnetd` string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990
CVE: CVE-2018-19987
Published: 2019-05-13
Description: D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code, the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990
CVE: CVE-2018-19988
Published: 2019-05-13
Description: In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed, the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element, such as the '`telnetd`' string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990
CVE: CVE-2018-19989
Published: 2019-05-13
Description: In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth internal configuration memory without any regex checking. And in the bwc_tc_spq_start, bwc_tc_wfq_start, and bwc_tc_adb_start functions of the bwcsvcs.php source code, the data in /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth is used with the tc command without any regex checking. A vulnerable /HNAP1/SetQoSSettings XML message could have shell metacharacters in the uplink element such as the `telnetd` string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990
CVE: CVE-2018-19990
Published: 2019-05-13
Description: In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pin" and $rphyinf3."/media/wps/enrollee/pin" internal configuration memory without any regex checking. And in the do_wps function of the wps.php source code, the data in $rphyinf3."/media/wps/enrollee/pin" is used with the wpatalk command without any regex checking. A vulnerable /HNAP1/SetWiFiVerifyAlpha XML message could have shell metacharacters in the WPSPIN element such as the `telnetd` string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990; https://github.com/pr0v3rbs/CVE/tree/master/CVE-2018-19986%20-%2019990
CVE: CVE-2019-12043
Published: 2019-05-13
Description: In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jonschlinkert/remarkable/issues/332; https://github.com/jonschlinkert/remarkable/issues/332
CVE: CVE-2019-7404
Published: 2019-05-13
Description: An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today's_date}.log for reading a filename such as gapm7100_190101.log.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/epistemophilia/CVEs/blob/master/LG-GAMP-Routers/CVE-2019-7404/poc-cve-2019-7404.py; https://github.com/epistemophilia/CVEs/blob/master/LG-GAMP-Routers/CVE-2019-7404/poc-cve-2019-7404.py