deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9950
Published: 2019-04-24
Description: Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials against /etc/shadow. However, the "nobody" account (which can be used to access the control panel API as a low-privilege logged-in user) has a default empty password, allowing an attacker to modify the My Cloud EX2 Ultra web page source code and obtain access to the My Cloud as a non-Admin My Cloud device user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://bnbdr.github.io/posts/wd/; https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932; https://github.com/bnbdr/wd-rce/
CVE: CVE-2019-9951
Published: 2019-04-24
Description: Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://bnbdr.github.io/posts/wd/; https://community.wd.com/t/new-release-my-cloud-firmware-versions-2-31-174-3-26-19/235932; https://github.com/bnbdr/wd-rce/
CVE: CVE-2019-10008
Published: 2019-04-24
Description: Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.exploit-db.com/exploits/46659; https://www.manageengine.com/products/service-desk/readme.html; https://www.exploit-db.com/exploits/46659
CVE: CVE-2019-11217
Published: 2019-04-24
Description: The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://bonobogitserver.com/changelog/#version-650; https://flab.cesnet.cz/advisories/cve-2019-11217; https://bonobogitserver.com/changelog/#version-650
CVE: CVE-2019-11218
Published: 2019-04-24
Description: Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated users to gain application administrator privileges via additional form parameter submissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://bonobogitserver.com/changelog/#version-650; https://flab.cesnet.cz/advisories/cve-2019-11218; https://bonobogitserver.com/changelog/#version-650
CVE: CVE-2017-18367
Published: 2019-04-24
Description: libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2019/04/25/6; https://access.redhat.com/errata/RHSA-2019:4087; https://access.redhat.com/errata/RHSA-2019:4090
CVE: CVE-2018-18251
Published: 2019-04-24
Description: Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on the client binary to enforce security rules and integrity of SQL statements and other content being sent to the server. Client HTTP calls can be manipulated by one of several means to execute arbitrary SQL statements (similar to SQLi) or possibly have unspecified other impact via this custom protocol. To perform these attacks an authenticated session is first required. In some cases client calls are obfuscated by encryption, which can be bypassed due to hard-coded keys and an insecure key rotation protocol. Impacts may include remote code execution in some deployments; however, the vendor states that this cannot occur when the installation documentation is heeded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-798
References: https://www.vsecurity.com/resources/advisories.html; https://www.vsecurity.com/resources/advisories.html
CVE: CVE-2018-20434
Published: 2019-04-24
Description: LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers html/includes/output/capture.inc.php command mishandling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153188/LibreNMS-addhost-Command-Injection.html; http://packetstormsecurity.com/files/153448/LibreNMS-1.46-addhost-Remote-Code-Execution.html; https://drive.google.com/file/d/1LcGmOY8x-TG-wnNr-cM_f854kxk0etva/view?usp=sharing
CVE: CVE-2018-7574
Published: 2019-04-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7576, CVE-2018-21233. Reason: this candidate was intended for one issue, but the description and references inadvertently combined multiple issues. Notes: All CVE users should consult CVE-2018-7576 and CVE-2018-21233 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-125, CWE-476
CVE: CVE-2018-7575
Published: 2019-04-24
Description: Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-004.md; https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-004.md
CVE: CVE-2019-11203
Published: 2019-04-24
Description: The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://www.securityfocus.com/bid/108057; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-11203
CVE: CVE-2019-11502
Published: 2019-04-24
Description: snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2019/04/25/7; https://github.com/snapcore/snapd/commit/bdbfeebef03245176ae0dc323392bb0522a339b1; https://www.openwall.com/lists/oss-security/2019/04/18/4
CVE: CVE-2019-11503
Published: 2019-04-24
Description: snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2019/04/25/7; https://github.com/snapcore/snapd/pull/6642; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VACEKVQ7UAZ32WO4ZKCFW6YOBSYJ76L/
CVE: CVE-2019-11504
Published: 2019-04-24
Description: Zotonic before version 0.47 has mod_admin XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel_0.47.0.html; http://packetstormsecurity.com/files/152717/Zotonic-0.46-mod_admin-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/46788/
CVE: CVE-2019-11505
Published: 2019-04-24
Description: In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/85f5bdcd246a; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html
CVE: CVE-2019-11506
Published: 2019-04-24
Description: In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/57ac0ae85e2a; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html
CVE: CVE-2019-8991
Published: 2019-04-24
Description: The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains multiple vulnerabilities that may allow for cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: http://www.securityfocus.com/bid/108059; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8991
CVE: CVE-2019-8992
Published: 2019-04-24
Description: The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability wherein a user without privileges to upload distributed application archives ("Upload DAA" permission) can theoretically upload arbitrary code, and in some circumstances then execute that code on ActiveMatrix Service Grid nodes. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/108058; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8992
CVE: CVE-2019-8993
Published: 2019-04-24
Description: The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/108056; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993
CVE: CVE-2019-8994
Published: 2019-04-24
Description: The workspace client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contains vulnerabilities where an authenticated user can change settings that can theoretically adversely impact other users. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/bid/108060; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-8994
CVE: CVE-2019-8995
Published: 2019-04-24
Description: The workspace client, openspace client, and app development client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain a vulnerability wherein a malicious URL could trick a user into visiting a website of the attacker's choice. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/108062; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-8995
CVE: CVE-2019-11511
Published: 2019-04-25
Description: Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/self-service-password/release-notes.html#5708; https://zeroauth.ltd/blog/2019/05/26/cve-2019-11511-zoho-manageengine-adselfservice-plus-xss/; https://www.manageengine.com/products/self-service-password/release-notes.html#5708
CVE: CVE-2019-11513
Published: 2019-04-25
Description: The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12022; http://dev.cmsmadesimple.org/bug/view/12022
CVE: CVE-2019-11514
Published: 2019-04-25
Description: User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released; https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7; https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released
CVE: CVE-2019-11515
Published: 2019-04-25
Description: core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://cisk123456.blogspot.com/2019/04/gila-cms-1101.html; https://cisk123456.blogspot.com/2019/04/gila-cms-1101.html
CVE: CVE-2019-11518
Published: 2019-04-25
Description: An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protection mechanism is incomplete.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.md; https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.md
CVE: CVE-2019-11519
Published: 2019-04-25
Description: Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://github.com/nopSolutions/nopCommerce/issues/3713; https://www.nopcommerce.com/boards/t/62390/xxe-version-390.aspx; https://github.com/nopSolutions/nopCommerce/issues/3713
CVE: CVE-2018-20823
Published: 2019-04-25
Description: The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal, aka a MEMS ultrasound attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://hackaday.com/2018/07/17/freak-out-your-smartphone-with-ultrasound/; https://medium.com/%40juliodellaflora/ultrassom-pode-causar-anomalias-no-girosc%C3%B3pio-do-xiaomi-mi5s-plus-4050d718bc7f; https://hackaday.com/2018/07/17/freak-out-your-smartphone-with-ultrasound/
CVE: CVE-2018-1720
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 147294.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147294; https://www.ibm.com/support/docview.wss?uid=ibm10880601; https://exchange.xforce.ibmcloud.com/vulnerabilities/147294
CVE: CVE-2019-3900
Published: 2019-04-25
Description: An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.
CVSS Score: 7.7 (HIGH)
CWE: CWE-835, CWE-835
References: http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://www.securityfocus.com/bid/108076; https://access.redhat.com/errata/RHSA-2019:1973
CVE: CVE-2019-4033
Published: 2019-04-25
Description: IBM Content Navigator 2.0.3 and 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155999.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/155999; https://www.ibm.com/support/docview.wss?uid=ibm10869046; https://exchange.xforce.ibmcloud.com/vulnerabilities/155999
CVE: CVE-2019-4073
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157107.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157107; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/157107
CVE: CVE-2019-4074
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157108.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157108; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/157108
CVE: CVE-2019-4075
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157109.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157109; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/157109
CVE: CVE-2019-4076
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157110.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157110; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/157110
CVE: CVE-2019-4077
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157111.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157111; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/157111