deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19979
Published: 2019-12-26
Description: A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://wpvulndb.com/vulnerabilities/9954; https://www.wordfence.com/blog/2019/11/high-severity-vulnerability-patched-in-wp-maintenance-plugin/; https://wpvulndb.com/vulnerabilities/9954
CVE: CVE-2019-19980
Published: 2019-12-26
Description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp_ajax function to send_test_email.
CVSS Score: 4.3 (MEDIUM)
References: https://wpvulndb.com/vulnerabilities/9946; https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/; https://wpvulndb.com/vulnerabilities/9946
CVE: CVE-2019-19981
Published: 2019-12-26
Description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpvulndb.com/vulnerabilities/9946; https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/; https://wpvulndb.com/vulnerabilities/9946
CVE: CVE-2019-19982
Published: 2019-12-26
Description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://wpvulndb.com/vulnerabilities/9946; https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/; https://wpvulndb.com/vulnerabilities/9946
CVE: CVE-2019-19983
Published: 2019-12-26
Description: In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://wpvulndb.com/vulnerabilities/9914; https://www.wordfence.com/blog/2019/10/medium-severity-vulnerability-patched-in-fast-velocity-minify-plugin/; https://wpvulndb.com/vulnerabilities/9914
CVE: CVE-2019-19984
Published: 2019-12-26
Description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://wpvulndb.com/vulnerabilities/9946; https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/; https://wpvulndb.com/vulnerabilities/9946
CVE: CVE-2019-19985
Published: 2019-12-26
Description: The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/158563/WordPress-Email-Subscribers-And-Newsletters-4.2.2-File-Disclosure.html; https://wpvulndb.com/vulnerabilities/9946; https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/
CVE: CVE-2019-19998
Published: 2019-12-26
Description: Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://gitee.com/xiuno/xiunobbs/issues/I177MY; https://gitee.com/xiuno/xiunobbs/issues/I177MY
CVE: CVE-2019-19999
Published: 2019-12-26
Description: Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://github.com/halo-dev/halo/compare/v1.1.3-beta.2...v1.2.0-beta.1; https://github.com/halo-dev/halo/issues/419; https://github.com/halo-dev/halo/issues/440
CVE: CVE-2019-20000
Published: 2019-12-26
Description: The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link attack, allowing privileged files to be deleted.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/BullGuard/Privileged%20File%20Delete/v20.0.371.8/README.md; https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/BullGuard/Privileged%20File%20Delete/v20.0.371.8/README.md
CVE: CVE-2019-15691
Published: 2019-12-26
Description: TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-825, CWE-672
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html; https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40; https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1
CVE: CVE-2019-15692
Published: 2019-12-26
Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html; https://github.com/CendioOssman/tigervnc/commit/996356b6c65ca165ee1ea46a571c32a1dc3c3821; https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1
CVE: CVE-2019-15693
Published: 2019-12-26
Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html; https://github.com/CendioOssman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95; https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1
CVE: CVE-2019-15694
Published: 2019-12-26
Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html; https://github.com/CendioOssman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438; https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1
CVE: CVE-2019-19540
Published: 2019-12-26
Description: The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9974; https://wpvulndb.com/vulnerabilities/9974
CVE: CVE-2019-19541
Published: 2019-12-26
Description: The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9974; https://wpvulndb.com/vulnerabilities/9974
CVE: CVE-2019-19542
Published: 2019-12-26
Description: The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9974; https://wpvulndb.com/vulnerabilities/9974
CVE: CVE-2019-15695
Published: 2019-12-26
Description: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-754, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html; https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89; https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1
CVE: CVE-2019-19681
Published: 2019-12-26
Description: Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://k4m1ll0.com/cve-2019-19681.html; https://medium.com/%40k4m1ll0/remote-code-execution-vulnerability-in-pandorafms-7-x-8ce55d4b1d5a; https://pandorafms.com/blog/pandora-fms-vulnerability/
CVE: CVE-2019-6008
Published: 2019-12-26
Description: An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and R3.15.00), Exaquantum/Batch (R1.01.00 ? R2.50.40), Exasmoc (all revisions), Exarqe (all revisions), GA10 (R1.01.01 ? R3.05.01), and InsightSuiteAE (R1.01.00 ? R1.06.00)) allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://jvn.jp/vu/JVNVU98228725/index.html; https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/; http://jvn.jp/vu/JVNVU98228725/index.html
CVE: CVE-2019-6011
Published: 2019-12-26
Description: Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN14776551/index.html; https://wordpress.org/plugins/wpdatatables/; http://jvn.jp/en/jp/JVN14776551/index.html
CVE: CVE-2019-6012
Published: 2019-12-26
Description: SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN14776551/index.html; https://wordpress.org/plugins/wpdatatables/; http://jvn.jp/en/jp/JVN14776551/index.html
CVE: CVE-2019-6013
Published: 2019-12-26
Description: DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN95875796/index.html; https://www.dlink-jp.com/product/dba-1510p#product_firmware; http://jvn.jp/en/jp/JVN95875796/index.html
CVE: CVE-2019-6014
Published: 2019-12-26
Description: DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://jvn.jp/en/jp/JVN95875796/index.html; https://www.dlink-jp.com/product/dba-1510p#product_firmware; http://jvn.jp/en/jp/JVN95875796/index.html
CVE: CVE-2019-6016
Published: 2019-12-26
Description: Cross-site scripting vulnerability in REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN59436681/index.html; http://www.remise.jp/data/pdf/20191002.pdf; http://jvn.jp/en/jp/JVN59436681/index.html
CVE: CVE-2019-6017
Published: 2019-12-26
Description: REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to [Disclosed_Information_type] via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN59436681/index.html; http://www.remise.jp/data/pdf/20191002.pdf; http://jvn.jp/en/jp/JVN59436681/index.html
CVE: CVE-2019-6018
Published: 2019-12-26
Description: Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN74530672/index.html; https://www.netcommons.org/blogs/blog_entries/view/6/7b40ca16fc8358a57d0e178c931c0027?frame_id=13; http://jvn.jp/en/jp/JVN74530672/index.html
CVE: CVE-2019-6019
Published: 2019-12-26
Description: Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN19386781/index.html; https://www.ipa.go.jp/ikc/info/20191126.html; http://jvn.jp/en/jp/JVN19386781/index.html
CVE: CVE-2019-6020
Published: 2019-12-26
Description: Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.x) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN34634458/index.html; https://www.powercms.jp/news/release-powercms-201910.html; http://jvn.jp/en/jp/JVN34634458/index.html
CVE: CVE-2019-6021
Published: 2019-12-26
Description: Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN45633549/index.html; https://www.ricoh.co.jp/limedio/user/; http://jvn.jp/en/jp/JVN45633549/index.html
CVE: CVE-2019-6022
Published: 2019-12-26
Description: Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'Customapp' function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN79854355/index.html; https://kb.cybozu.support/article/36124; http://jvn.jp/en/jp/JVN79854355/index.html
CVE: CVE-2019-6023
Published: 2019-12-26
Description: Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction which may result in obtaining data without access privileges via the application 'Address'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN79854355/index.html; https://kb.cybozu.support/article/36130; http://jvn.jp/en/jp/JVN79854355/index.html
CVE: CVE-2019-6024
Published: 2019-12-26
Description: Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and obtain the user's authentication information via a malicious application created by the third party.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://jvn.jp/en/jp/JVN41566067/index.html; https://apps.apple.com/jp/app/furimaapuri-furiru-fril-fasshon/id523497998; https://play.google.com/store/apps/details?id=jp.co.fablic.fril&hl=en
CVE: CVE-2019-6025
Published: 2019-12-26
Description: Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Advanced 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type Advanced 6.5.0 and 6.5.1 (Movable Type 6.5), Movable Type Advanced 6.3.9 and earlier (Movable Type 6.3.x, 6.2.x, 6.1.x, 6.0.x), Movable Type Premium 1.24 and earlier (Movable Type Premium), and Movable Type Premium (Advanced Edition) 1.24 and earlier (Movable Type Premium) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN65280626/index.html; https://movabletype.org/news/2019/11/movable_type_r4603_v714_v652_and_v6310_released.html; http://jvn.jp/en/jp/JVN65280626/index.html
CVE: CVE-2019-6026
Published: 2019-12-26
Description: Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScope Cat detection agent (DA) prior to Ver.9.2.1.0, LanScope Cat server monitoring agent (SA, SAE) prior to Ver.9.2.2.0, LanScope An prior to Ver 2.7.7.0 (LanScope An 2 series), and LanScope An prior to Ver 3.0.8.1 (LanScope An 3 series)) allow authenticated attackers to obtain unauthorized privileges and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN49068796/index.html; https://www.motex.co.jp/news/news_topics/2019/release191202/; http://jvn.jp/en/jp/JVN49068796/index.html
CVE: CVE-2019-6027
Published: 2019-12-26
Description: Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN26838191/index.html; https://wordpress.org/plugins/wp-spell-check/; http://jvn.jp/en/jp/JVN26838191/index.html
CVE: CVE-2019-6029
Published: 2019-12-26
Description: Cross-site scripting vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN26847507/index.html; https://wordpress.org/plugins/wp-custom-body-class/; http://jvn.jp/en/jp/JVN26847507/index.html
CVE: CVE-2019-6030
Published: 2019-12-26
Description: Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN26847507/index.html; https://wordpress.org/plugins/wp-custom-body-class/; http://jvn.jp/en/jp/JVN26847507/index.html
CVE: CVE-2019-6031
Published: 2019-12-26
Description: Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via RSS reader.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN63047298/index.html; https://www.kinza.jp/download/releases/; http://jvn.jp/en/jp/JVN63047298/index.html
CVE: CVE-2019-6032
Published: 2019-12-26
Description: The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN01236065/index.html; https://play.google.com/store/apps/details?id=jp.co.ntv.news24&hl=en; http://jvn.jp/en/jp/JVN01236065/index.html
CVE: CVE-2019-6033
Published: 2019-12-26
Description: Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN10377257/index.html; https://developer.a-blogcms.jp/download/legacy.html; http://jvn.jp/en/jp/JVN10377257/index.html
CVE: CVE-2019-6034
Published: 2019-12-26
Description: a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be executed in the context of the application due to unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: http://jvn.jp/en/jp/JVN10377257/index.html; https://developer.a-blogcms.jp/download/legacy.html; http://jvn.jp/en/jp/JVN10377257/index.html
CVE: CVE-2019-6035
Published: 2019-12-26
Description: Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN57070811/index.html; https://github.com/yahoo/athenz; https://github.com/yahoo/athenz/pull/700
CVE: CVE-2018-20492
Published: 2019-12-26
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control (issue 2 of 6).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2019-16780
Published: 2019-12-26
Description: WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordPress/wordpress-develop/commit/505dd6a20b6fc3d06130018c1caeff764248c29e; https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x3wp-h3qx-9w94; https://hackerone.com/reports/738644
CVE: CVE-2019-16781
Published: 2019-12-26
Description: In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v; https://hackerone.com/reports/731301; https://seclists.org/bugtraq/2020/Jan/8