deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1755
Published: 2019-03-28
Description: A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary Cisco IOS commands as a privilege level 15 user. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker could exploit this vulnerability by submitting crafted HTTP requests to the targeted application. A successful exploit could allow the attacker to execute arbitrary commands on the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107380; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-cmdinj; http://www.securityfocus.com/bid/107380
CVE: CVE-2019-1756
Published: 2019-03-28
Description: A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying a username with a malicious payload in the web UI and subsequently making a request to a specific endpoint in the web UI. A successful exploit could allow the attacker to run arbitrary commands as the root user, allowing complete compromise of the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107598; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-cmdinject; http://www.securityfocus.com/bid/107598
CVE: CVE-2019-1757
Published: 2019-03-28
Description: A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/107617; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-call-home-cert; http://www.securityfocus.com/bid/107617
CVE: CVE-2019-1758
Published: 2019-03-28
Description: A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the network prior to authentication. The vulnerability is due to how the 802.1x packets are handled in the process path. An attacker could exploit this vulnerability by attempting to connect to the network on an 802.1x configured port. A successful exploit could allow the attacker to intermittently obtain access to the network.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/107616; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-c6500; http://www.securityfocus.com/bid/107616
CVE: CVE-2019-1759
Published: 2019-03-28
Description: A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the Gigabit Ethernet Management interface. The vulnerability is due to a logic error that was introduced in the Cisco IOS XE Software 16.1.1 Release, which prevents the ACL from working when applied against the management interface. An attacker could exploit this issue by attempting to access the device via the management interface.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-287
References: http://www.securityfocus.com/bid/107660; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-mgmtacl; http://www.securityfocus.com/bid/107660
CVE: CVE-2019-1760
Published: 2019-03-28
Description: A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload. The vulnerability is due to the processing of malformed smart probe packets. An attacker could exploit this vulnerability by sending specially crafted smart probe packets at the affected device. A successful exploit could allow the attacker to reload the device, resulting in a denial of service (DoS) attack on an affected system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107611; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-pfrv3; http://www.securityfocus.com/bid/107611
CVE: CVE-2019-1761
Published: 2019-03-28
Description: A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to receive potentially sensitive information from an affected device. The vulnerability is due to insufficient memory initialization. An attacker could exploit this vulnerability by receiving HSRPv2 traffic from an adjacent HSRP member. A successful exploit could allow the attacker to receive potentially sensitive information from the adjacent device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-665, CWE-665
References: http://www.securityfocus.com/bid/107620; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-ios-infoleak; http://www.securityfocus.com/bid/107620
CVE: CVE-2019-1762
Published: 2019-03-28
Description: A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time, when affected software handles configuration updates. An attacker could exploit this vulnerability by retrieving the contents of specific memory locations of an affected device. A successful exploit could result in the disclosure of keying materials that are part of the device configuration, which can be used to recover critical system information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/107594; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-info; http://www.securityfocus.com/bid/107594
CVE: CVE-2017-18365
Published: 2019-03-28
Description: The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://enterprise.github.com/releases/2.8.7/notes; https://www.exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html; https://enterprise.github.com/releases/2.8.7/notes
CVE: CVE-2019-10250
Published: 2019-03-28
Description: UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/; https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/
CVE: CVE-2019-3869
Published: 2019-03-28
Description: When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-214, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869; https://github.com/ansible/awx/pull/3505; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869
CVE: CVE-2019-6542
Published: 2019-03-28
Description: ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated user to initiate a remote reboot, which may be used to cause a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-085-03-0; https://ics-cert.us-cert.gov/advisories/ICSA-19-085-03-0
CVE: CVE-2019-7524
Published: 2019-03-28
Description: In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html; http://www.openwall.com/lists/oss-security/2019/03/28/1
CVE: CVE-2019-5025
Published: 2019-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2018-20144
Published: 2019-03-28
Description: GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55200
CVE: CVE-2019-10251
Published: 2019-03-28
Description: The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related to libpicsel), which allows MITM attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://news.drweb.com/show/?i=13176&c=38; https://www.bleepingcomputer.com/news/security/uc-browser-for-android-desktop-exposes-500-million-users-to-mitm-attacks/; https://news.drweb.com/show/?i=13176&c=38
CVE: CVE-2019-10254
Published: 2019-03-28
Description: In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/586cca384be6710b03e14bcbeb7588c1772604ec; https://github.com/MISP/MISP/compare/f493659...0e4f66e; https://github.com/MISP/MISP/commit/586cca384be6710b03e14bcbeb7588c1772604ec
CVE: CVE-2019-5674
Published: 2019-03-28
Description: NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: http://support.lenovo.com/us/en/solutions/LEN-27096; http://www.securityfocus.com/bid/107621; https://nvidia.custhelp.com/app/answers/detail/a_id/4784
CVE: CVE-2019-9864
Published: 2019-03-28
Description: PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount.
CVSS Score: 6.5 (MEDIUM)
References: https://hackingvila.wordpress.com/2019/03/19/php-scripts-mall-amazon-affiliate-store-2-1-6-allows-parameter-tampering-of-the-payment-amountcve-2019-9864/; https://hackingvila.wordpress.com/2019/03/19/php-scripts-mall-amazon-affiliate-store-2-1-6-allows-parameter-tampering-of-the-payment-amountcve-2019-9864/
CVE: CVE-2019-5026
Published: 2019-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-5027
Published: 2019-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-5028
Published: 2019-03-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2018-20678
Published: 2019-03-28
Description: LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert.enea.pl/advisories/cert-190101.html; https://github.com/librenms/librenms/commits/master/html/ajax_table.php; https://cert.enea.pl/advisories/cert-190101.html
CVE: CVE-2018-6330
Published: 2019-03-28
Description: Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.itblog.gbonanno.de/cve-2018-6330-laravel-sql-injection/; https://github.com/laravel/framework/blob/5.4/CHANGELOG-5.4.md; http://www.itblog.gbonanno.de/cve-2018-6330-laravel-sql-injection/
CVE: CVE-2019-10255
Published: 2019-03-28
Description: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4; https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb; https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
CVE: CVE-2018-16529
Published: 2019-03-28
Description: A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://help.forcepoint.com/security/CVE/CVE-2018-16529.html; https://seclists.org/fulldisclosure/2018/Nov/23; https://help.forcepoint.com/security/CVE/CVE-2018-16529.html
CVE: CVE-2018-19879
Published: 2019-03-28
Description: An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login attempts with an automated tool. This ability could lead to cracking a targeted user's password.
CVSS Score: 7.1 (HIGH)
CWE: CWE-307
References: https://wiki.teltonika.lt/index.php?title=RUT9xx_Firmware; https://www.triadsec.com/CVE-2018-19879.pdf; https://wiki.teltonika.lt/index.php?title=RUT9xx_Firmware
CVE: CVE-2019-10260
Published: 2019-03-28
Description: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/totaljs/cms/commit/75205f93009db3cf8c0b0f4f1fc8ab82d70da8ad; https://github.com/totaljs/cms/commit/8b9d7dada998c08d172481d9f0fc0397c4b3c78d; https://github.com/totaljs/cms/commit/75205f93009db3cf8c0b0f4f1fc8ab82d70da8ad
CVE: CVE-2019-5737
Published: 2019-03-28
Description: In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html
CVE: CVE-2019-5739
Published: 2019-03-28
Description: Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html; https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
CVE: CVE-2019-7251
Published: 2019-03-28
Description: An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://downloads.asterisk.org/pub/security/AST-2019-001.html; https://issues.asterisk.org/jira/browse/ASTERISK-28260; https://downloads.asterisk.org/pub/security/AST-2019-001.html
CVE: CVE-2019-9164
Published: 2019-03-28
Description: Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2019/Apr/19; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-470
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://access.redhat.com/errata/RHSA-2019:1423
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-470
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://access.redhat.com/errata/RHSA-2019:1423
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://access.redhat.com/errata/RHSA-2019:1423
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-846
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-28
Description: A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.
CVSS Score: 7.8 (HIGH)
CWE: CWE-311
References: http://www.openwall.com/lists/oss-security/2019/03/28/2; http://www.securityfocus.com/bid/107628; https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089
CVE: CVE-2019-3710
Published: 2019-03-28
Description: Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to intercept communications or operate the system with elevated privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://www.dell.com/support/article/SLN316558/; https://www.dell.com/support/article/SLN316558/
CVE: CVE-2019-9165
Published: 2019-03-28
Description: SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html; https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/products/security/
CVE: CVE-2019-9202
Published: 2019-03-28
Description: Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html; https://www.nagios.com/products/security/; http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html