deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13377
Published: 2019-08-15
Description: The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IELLEPIXWQOJFW4SZMU3WQHO63JFAHA4/; https://seclists.org/bugtraq/2019/Sep/56; https://usn.ubuntu.com/4098-1/
CVE: CVE-2019-14422
Published: 2019-08-15
Description: An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which could be used to open remote workbooks without protection from macro security settings to execute arbitrary code. A tsvncmd:command:diff?path:[file1]?path2:[file2] URI will execute a customised diff on [file1] and [file2] based on the file extension. For xls files, it will execute the script diff-xls.js using wscript, which will open the two files for analysis without any macro security warning. An attacker can exploit this by putting a macro virus in a network drive, and force the victim to open the workbooks and execute the macro inside.
CVSS Score: 8.8 (HIGH)
References: http://seclists.org/fulldisclosure/2019/Aug/7; https://www.vulnerability-lab.com/get_content.php?id=2188; http://seclists.org/fulldisclosure/2019/Aug/7
CVE: CVE-2019-9013
Published: 2019-08-15
Description: An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-327
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=; https://www.us-cert.gov/ics/advisories/icsa-19-213-04; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=
CVE: CVE-2018-14668
Published: 2019-08-15
Description: In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://clickhouse.yandex/docs/en/security_changelog/; https://clickhouse.yandex/docs/en/security_changelog/
CVE: CVE-2018-14669
Published: 2019-08-15
Description: ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://clickhouse.yandex/docs/en/security_changelog/; https://clickhouse.yandex/docs/en/security_changelog/
CVE: CVE-2018-14670
Published: 2019-08-15
Description: Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://clickhouse.yandex/docs/en/security_changelog/; https://clickhouse.yandex/docs/en/security_changelog/
CVE: CVE-2018-14671
Published: 2019-08-15
Description: In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://clickhouse.yandex/docs/en/security_changelog/; https://clickhouse.yandex/docs/en/security_changelog/
CVE: CVE-2018-14672
Published: 2019-08-15
Description: In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://clickhouse.yandex/docs/en/security_changelog/; https://clickhouse.yandex/docs/en/security_changelog/
CVE: CVE-2019-9010
Published: 2019-08-15
Description: An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
CVSS Score: 9.8 (CRITICAL)
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12937&token=769045a17015bea00ec7ff313de8f1a5c73e7b93&download=; https://www.us-cert.gov/ics/advisories/icsa-19-213-03; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12937&token=769045a17015bea00ec7ff313de8f1a5c73e7b93&download=
CVE: CVE-2019-9012
Published: 2019-08-15
Description: An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=; https://www.us-cert.gov/ics/advisories/icsa-19-213-03; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12938&token=b9eb30f53246dc57b2e7cb302356a05547148fa2&download=
CVE: CVE-2019-12809
Published: 2019-08-15
Description: Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35117; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35117
CVE: CVE-2019-13510
Published: 2019-08-15
Description: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-05; https://www.zerodayinitiative.com/advisories/ZDI-19-1000/; https://www.zerodayinitiative.com/advisories/ZDI-19-800/
CVE: CVE-2019-13511
Published: 2019-08-15
Description: Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by an unsuspecting user may result in the limited exposure of information related to the targeted workstation.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-416
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-05; https://www.zerodayinitiative.com/advisories/ZDI-20-810/; https://www.zerodayinitiative.com/advisories/ZDI-20-811/
CVE: CVE-2019-13512
Published: 2019-08-15
Description: Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limited information from the device.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-02; https://www.us-cert.gov/ics/advisories/icsa-19-213-02
CVE: CVE-2019-13513
Published: 2019-08-15
Description: In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger multiple out-of-bounds read vulnerabilities, which may allow information disclosure, remote code execution, or crash of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-19-225-01; https://www.zerodayinitiative.com/advisories/ZDI-19-718/; https://www.zerodayinitiative.com/advisories/ZDI-19-719/
CVE: CVE-2019-13514
Published: 2019-08-15
Description: In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-free vulnerability, which may allow information disclosure, remote code execution, or crash of the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.us-cert.gov/ics/advisories/icsa-19-225-01; https://www.zerodayinitiative.com/advisories/ZDI-19-717/; https://www.us-cert.gov/ics/advisories/icsa-19-225-01
CVE: CVE-2019-13515
Published: 2019-08-15
Description: OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.us-cert.gov/ics/advisories/icsa-19-225-02; https://www.us-cert.gov/ics/advisories/icsa-19-225-02
CVE: CVE-2019-13516
Published: 2019-08-15
Description: In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693, CWE-352
References: https://www.us-cert.gov/ics/advisories/icsa-19-225-02; https://www.us-cert.gov/ics/advisories/icsa-19-225-02
CVE: CVE-2019-3974
Published: 2019-08-15
Description: Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, potentially creating a denial of service condition.
CVSS Score: 8.1 (HIGH)
References: https://www.tenable.com/security/tns-2019-05; https://www.tenable.com/security/tns-2019-05
CVE: CVE-2018-14062
Published: 2019-08-15
Description: The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send private messages (unrelated to distress alerts) via a crafted 406 MHz digital signal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-310
References: https://conference.hitb.org/hitbsecconf2019ams/materials/D1T1%20-%20The%20Birdman%20and%20Cospas-Sarsat%20Satellites%20-%20Hao%20Jingli.pdf; https://conference.hitb.org/hitbsecconf2019ams/sessions/the-birdman-hacking-cospas-sarsat-satellites/; https://conference.hitb.org/hitbsecconf2019ams/materials/D1T1%20-%20The%20Birdman%20and%20Cospas-Sarsat%20Satellites%20-%20Hao%20Jingli.pdf
CVE: CVE-2019-12791
Published: 2019-08-15
Description: A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-password-reset-form/; https://github.com/serghey-rodin/vesta/issues/1921; https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-password-reset-form/
CVE: CVE-2019-12792
Published: 2019-08-15
Description: A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-upload-handler/; https://github.com/serghey-rodin/vesta/issues/1921; https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-upload-handler/
CVE: CVE-2019-10081
Published: 2019-08-15
Description: HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E
CVE: CVE-2019-9850
Published: 2019-08-15
Description: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html; https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
CVE: CVE-2019-9851
Published: 2019-08-15
Description: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html; http://packetstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.html
CVE: CVE-2019-9852
Published: 2019-08-15
Description: LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-116, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html; https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html
CVE: CVE-2019-15084
Published: 2019-08-16
Description: Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result, a local attacker can escalate to SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.exploit-db.com/exploits/46416; https://www.exploit-db.com/exploits/46416
CVE: CVE-2019-15090
Published: 2019-08-16
Description: An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.12
CVE: CVE-2019-15095
Published: 2019-08-16
Description: DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wkeyuan/DWSurvey/issues/48; https://github.com/wkeyuan/DWSurvey/issues/48
CVE: CVE-2019-15098
Published: 2019-08-16
Description: drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-15099
Published: 2019-08-16
Description: drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://lore.kernel.org/linux-wireless/[PII_REDACTED]3101.11541-1-benquike%40gmail.com/T/#u; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2016-10894
Published: 2019-08-16
Description: xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-254
References: https://bugs.debian.org/830726; https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html; https://bugs.debian.org/830726
CVE: CVE-2019-15104
Published: 2019-08-16
Description: An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/47227; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15104.html
CVE: CVE-2019-15105
Published: 2019-08-16
Description: An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://pentest.com.tr/exploits/DEFCON-ManageEngine-APM-v14-Privilege-Escalation-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/47228; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15105.html
CVE: CVE-2019-15106
Published: 2019-08-16
Description: An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Unauthenticated-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/47229; https://www.manageengine.com/network-monitoring/security-updates/cve-2019-15106.html
CVE: CVE-2019-15107
Published: 2019-08-16
Description: An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html; http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html; http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html
CVE: CVE-2018-20969
Published: 2019-08-16
Description: do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html; https://access.redhat.com/errata/RHSA-2019:2798; https://access.redhat.com/errata/RHSA-2019:2964
CVE: CVE-2019-15108
Published: 2019-08-16
Description: An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0597; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0597
CVE: CVE-2019-14923
Published: 2019-08-16
Description: EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/47280; https://www.eyesofnetwork.com/?p=2072; https://www.exploit-db.com/exploits/47280
CVE: CVE-2019-15091
Published: 2019-08-16
Description: filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://pastebin.com/k7FuvNvx; https://pastebin.com/k7FuvNvx
CVE: CVE-2015-9325
Published: 2019-08-16
Description: The visitors-online plugin before 0.4 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/visitors-online/#developers; https://wordpress.org/plugins/visitors-online/#developers
CVE: CVE-2015-9326
Published: 2019-08-16
Description: The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/wp-business-intelligence-lite/#developers; https://wordpress.org/plugins/wp-business-intelligence-lite/#developers
CVE: CVE-2016-10904
Published: 2019-08-16
Description: The olimometer plugin before 2.57 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/olimometer/#developers; https://wordpress.org/plugins/olimometer/#developers