deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14683
Published: 2019-08-08
Description: The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta?rev=2112013; https://wordpress.org/plugins/import-users-from-csv-with-meta/#developers; https://wpvulndb.com/vulnerabilities/9392
CVE: CVE-2019-14773
Published: 2019-08-08
Description: admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
CVSS Score: 7.5 (HIGH)
References: https://wordpress.org/plugins/insert-php/#developers; https://www.pluginvulnerabilities.com/2019/08/01/post-deletion-vulnerability-in-woody-ad-snippets/; https://wordpress.org/plugins/insert-php/#developers
CVE: CVE-2019-14774
Published: 2019-08-08
Description: The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9855; https://www.pluginvulnerabilities.com/2019/07/30/reflected-cross-site-scripting-xss-vulnerability-in-woocommerce-variation-swatches/; https://wpvulndb.com/vulnerabilities/9855
CVE: CVE-2015-9292
Published: 2019-08-08
Description: 6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2016-10862
Published: 2019-08-08
Description: Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.pentestpartners.com/security-blog/a-neet-csrf-to-reverse-shell-in-wi-fi-music-streamer/; https://www.pentestpartners.com/security-blog/a-neet-csrf-to-reverse-shell-in-wi-fi-music-streamer/
CVE: CVE-2016-10863
Published: 2019-08-08
Description: Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.pentestpartners.com/security-blog/edimax-wi-fi-extender-can-disclose-your-wpa-key/; https://www.pentestpartners.com/security-blog/edimax-wi-fi-extender-can-disclose-your-wpa-key/
CVE: CVE-2017-18484
Published: 2019-08-08
Description: Cognitoys Dino devices allow XSS via the SSID.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.pentestpartners.com/security-blog/jurassic-poke-hacking-a-dino-toy/; https://www.pentestpartners.com/security-blog/jurassic-poke-hacking-a-dino-toy/
CVE: CVE-2017-18485
Published: 2019-08-08
Description: Cognitoys Dino devices allow profiles_add.html CSRF.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://www.pentestpartners.com/security-blog/jurassic-poke-hacking-a-dino-toy/; https://www.pentestpartners.com/security-blog/jurassic-poke-hacking-a-dino-toy/
CVE: CVE-2018-20954
Published: 2019-08-08
Description: The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e; https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4; https://github.com/mailpile/Mailpile/pull/2145
CVE: CVE-2018-20955
Published: 2019-08-08
Description: Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.pentestpartners.com/security-blog/hacking-swann-home-security-camera-video/; https://www.swann.com/au/safe-by-swann-upgrade; https://www.pentestpartners.com/security-blog/hacking-swann-home-security-camera-video/
CVE: CVE-2018-20956
Published: 2019-08-08
Description: Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://www.pentestpartners.com/security-blog/hacking-swann-home-security-camera-video/; https://www.swann.com/au/safe-by-swann-upgrade; https://www.pentestpartners.com/security-blog/hacking-swann-home-security-camera-video/
CVE: CVE-2018-20957
Published: 2019-08-08
Description: The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://tapplock.com/notice/20180612/; https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock/; https://tapplock.com/notice/20180612/
CVE: CVE-2018-20960
Published: 2019-08-08
Description: Nespresso Prodigio devices lack Bluetooth connection security.
CVSS Score: 8.1 (HIGH)
References: https://www.pentestpartners.com/security-blog/hacking-the-nespresso-prodigio-and-jura-e8-coffee-machines/; https://www.pentestpartners.com/security-blog/hacking-the-nespresso-prodigio-and-jura-e8-coffee-machines/
CVE: CVE-2019-14783
Published: 2019-08-08
Description: On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/154615/Samsung-Mobile-Android-FotaAgent-Arbitrary-File-Creation.html; http://seclists.org/fulldisclosure/2019/Sep/33; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2016-10865
Published: 2019-08-09
Description: The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/lightbox-plus/#developers; https://www.pluginvulnerabilities.com/2016/04/05/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-lightbox-plus-colorbox/; https://wordpress.org/plugins/lightbox-plus/#developers
CVE: CVE-2019-14234
Published: 2019-08-09
Description: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html; https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
CVE: CVE-2019-14312
Published: 2019-08-09
Description: Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153985/Aptana-Jaxer-1.0.3.4547-Local-File-Inclusion.html; https://github.com/aptana/Jaxer/commits/master; http://packetstormsecurity.com/files/153985/Aptana-Jaxer-1.0.3.4547-Local-File-Inclusion.html
CVE: CVE-2019-14785
Published: 2019-08-09
Description: The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers; https://www.pluginvulnerabilities.com/2019/06/24/reflected-cross-site-scripting-xss-vulnerability-in-cp-contact-form-with-paypal/; https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
CVE: CVE-2019-14787
Published: 2019-08-09
Description: The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/newsletters-lite/#developers; https://wpvulndb.com/vulnerabilities/9447; https://www.pluginvulnerabilities.com/2019/07/01/reflected-cross-site-scripting-xss-vulnerability-in-newsletters/
CVE: CVE-2019-14792
Published: 2019-08-09
Description: The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-google-maps/#developers; https://wpvulndb.com/vulnerabilities/9442; https://www.pluginvulnerabilities.com/2019/07/08/recently-closed-wordpress-plugin-with-400000-installs-contains-another-authenticated-persistent-xss-vulnerability/
CVE: CVE-2019-14793
Published: 2019-08-09
Description: The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://metabox.io/changelog/; https://www.pluginvulnerabilities.com/2019/02/01/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs/; https://metabox.io/changelog/
CVE: CVE-2019-14799
Published: 2019-08-09
Description: The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers; https://wpvulndb.com/vulnerabilities/9278; https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player/
CVE: CVE-2019-14791
Published: 2019-08-09
Description: The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/appointment-booking-calendar/#developers; https://wpvulndb.com/vulnerabilities/9426; https://www.pluginvulnerabilities.com/2019/07/03/hackers-look-to-be-targeting-the-wordpress-plugin-appointment-booking-calendar-which-is-yet-another-insecure-plugin-from-code-people/
CVE: CVE-2019-14794
Published: 2019-08-09
Description: The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://metabox.io/changelog/; https://metabox.io/changelog/
CVE: CVE-2019-14796
Published: 2019-08-09
Description: The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/mq-woocommerce-products-price-bulk-edit/#developers; https://wpvulndb.com/vulnerabilities/9515; https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-woocommerce-products-price-bulk-edit-for/
CVE: CVE-2019-14797
Published: 2019-08-09
Description: The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/photo-gallery/#developers; https://wordpress.org/plugins/photo-gallery/#developers
CVE: CVE-2019-14798
Published: 2019-08-09
Description: The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://wordpress.org/plugins/photo-gallery/#developers; https://wpvulndb.com/vulnerabilities/9361; https://www.pluginvulnerabilities.com/2019/05/14/authenticated-local-file-inclusion-lfi-vulnerability-in-photo-gallery-by-10web/
CVE: CVE-2019-14801
Published: 2019-08-09
Description: The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers; https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
CVE: CVE-2019-14804
Published: 2019-08-09
Description: studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154018/UNA-10.0.0-RC1-Cross-Site-Scripting.html; https://github.com/unaio/una/commits/master/studio; https://pastebin.com/iMfs1BsM
CVE: CVE-2019-14805
Published: 2019-08-09
Description: studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/unaio/una/commits/master/studio; https://pastebin.com/BRFQkqLQ; https://github.com/unaio/una/commits/master/studio
CVE: CVE-2019-14806
Published: 2019-08-09
Description: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html; https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168
CVE: CVE-2018-20858
Published: 2019-08-09
Description: Recommender before 2018-07-18 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/edx/RecommenderXBlock/pull/2; https://groups.google.com/forum/#%21topic/openedx-announce/SF8Sn6MuUTg; https://github.com/edx/RecommenderXBlock/pull/2
CVE: CVE-2017-18486
Published: 2019-08-09
Description: Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-332
References: https://github.com/Kc57/JitBit_Helpdesk_Auth_Bypass; https://packetstormsecurity.com/files/144334/JitBit-Helpdesk-9.0.2-Broken-Authentication.html; https://www.exploit-db.com/exploits/42776
CVE: CVE-2019-12805
Published: 2019-08-09
Description: NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. This can be leveraged for code execution in the context of the current user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35106; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35106
CVE: CVE-2019-5395
Published: 2019-08-09
Description: A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-5396
Published: 2019-08-09
Description: A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 9.4 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-12256
Published: 2019-08-09
Description: Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-12257
Published: 2019-08-09
Description: Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
CVE: CVE-2019-5397
Published: 2019-08-09
Description: A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-5398
Published: 2019-08-09
Description: A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-5399
Published: 2019-08-09
Description: A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 9.4 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-5400
Published: 2019-08-09
Description: A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03942en_us
CVE: CVE-2019-5402
Published: 2019-08-09
Description: A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 9.4 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5403
Published: 2019-08-09
Description: A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5404
Published: 2019-08-09
Description: A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5405
Published: 2019-08-09
Description: A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 7.3 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5406
Published: 2019-08-09
Description: A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-384
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5407
Published: 2019-08-09
Description: A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.
CVSS Score: 6.3 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE: CVE-2019-5408
Published: 2019-08-09
Description: Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.
CVSS Score: 6.5 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us
CVE: CVE-2019-5498
Published: 2019-08-09
Description: OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-11776
Published: 2019-08-09
Description: In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546816; https://bugs.eclipse.org/bugs/show_bug.cgi?id=546816
CVE: CVE-2019-12259
Published: 2019-08-09
Description: Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf