deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-1829
Published: 2019-03-14
Description: IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150432.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875318; http://www.securityfocus.com/bid/107433; https://exchange.xforce.ibmcloud.com/vulnerabilities/150432
CVE: CVE-2018-1908
Published: 2019-03-14
Description: IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152671.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10739253; http://www.securityfocus.com/bid/107431; https://exchange.xforce.ibmcloud.com/vulnerabilities/152671
CVE: CVE-2018-1910
Published: 2019-03-14
Description: IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152734.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875372; http://www.securityfocus.com/bid/107423; https://exchange.xforce.ibmcloud.com/vulnerabilities/152734
CVE: CVE-2018-1914
Published: 2019-03-14
Description: IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152738.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875372; http://www.securityfocus.com/bid/107423; https://exchange.xforce.ibmcloud.com/vulnerabilities/152738
CVE: CVE-2018-1916
Published: 2019-03-14
Description: IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152740.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875340; http://www.securityfocus.com/bid/107435; https://exchange.xforce.ibmcloud.com/vulnerabilities/152740
CVE: CVE-2018-1929
Published: 2019-03-14
Description: IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10875372; http://www.securityfocus.com/bid/107423; https://exchange.xforce.ibmcloud.com/vulnerabilities/153120
CVE: CVE-2018-1952
Published: 2019-03-14
Description: IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153495.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875340; http://www.securityfocus.com/bid/107435; https://exchange.xforce.ibmcloud.com/vulnerabilities/153495
CVE: CVE-2018-1982
Published: 2019-03-14
Description: IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154135.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875364; http://www.securityfocus.com/bid/107419; https://exchange.xforce.ibmcloud.com/vulnerabilities/154135
CVE: CVE-2018-1983
Published: 2019-03-14
Description: IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154136.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875364; http://www.securityfocus.com/bid/107419; https://exchange.xforce.ibmcloud.com/vulnerabilities/154136
CVE: CVE-2018-1984
Published: 2019-03-14
Description: IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154137.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10875364; http://www.securityfocus.com/bid/107419; https://exchange.xforce.ibmcloud.com/vulnerabilities/154137
CVE: CVE-2019-3816
Published: 2019-03-14
Description: Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://bugzilla.suse.com/show_bug.cgi?id=1122623; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html
CVE: CVE-2019-3833
Published: 2019-03-14
Description: Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: http://bugzilla.suse.com/show_bug.cgi?id=1122623; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html
CVE: CVE-2019-4034
Published: 2019-03-14
Description: IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with Edit service, it will be executed on the user's workstation. IBM X-Force ID: 156000.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/107426; https://exchange.xforce.ibmcloud.com/vulnerabilities/156000; https://www.ibm.com/support/docview.wss?uid=ibm10869066
CVE: CVE-2019-9825
Published: 2019-03-14
Description: FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://blog.whiterabbitxyj.com/cve/FeiFeiCMS_4.1_code_execution.doc; https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/FeiFeiCMS_4.1_code_execution.doc; http://blog.whiterabbitxyj.com/cve/FeiFeiCMS_4.1_code_execution.doc
CVE: CVE-2019-9829
Published: 2019-03-15
Description: Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.md; https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.md
CVE: CVE-2018-18252
Published: 2019-03-15
Description: An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users via the --system option.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://improsec.com/tech-blog/cam1; https://improsec.com/tech-blog/cam1
CVE: CVE-2018-18253
Published: 2019-03-15
Description: An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, and there is also a race condition in all cases.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://improsec.com/tech-blog/cam1; https://improsec.com/tech-blog/cam1
CVE: CVE-2018-18254
Published: 2019-03-15
Description: An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the cal_whitelist table in the Custom App Launcher (CAL) database, and potentially gain privileges by placing a Trojan horse program at an app pathname.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://improsec.com/tech-blog/cam1; https://improsec.com/tech-blog/cam1
CVE: CVE-2018-18255
Published: 2019-03-15
Description: An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this server through named pipes. A user can initiate communication with the server by creating a named pipe and sending commands to achieve elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://improsec.com/tech-blog/cam1; https://improsec.com/tech-blog/cam1
CVE: CVE-2018-18256
Published: 2019-03-15
Description: An issue was discovered in CapMon Access Manager 5.4.1.1005. A regular user can obtain local administrator privileges if they run any whitelisted application through the Custom App Launcher.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://improsec.com/tech-blog/cam1; https://improsec.com/tech-blog/cam1
CVE: CVE-2018-19391
Published: 2019-03-15
Description: Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyberskr.com/blog/cobham-satcom-250-500.html; https://gist.github.com/CyberSKR/f6fc93702b9b9b73afa07877d1479fe0; https://cyberskr.com/blog/cobham-satcom-250-500.html
CVE: CVE-2018-19392
Published: 2019-03-15
Description: Cobham Satcom Sailor 250 and 500 devices before 1.25 contained an unauthenticated password reset vulnerability. This could allow modification of any user account's password (including the default "admin" account), without prior knowledge of their password. All that is required is knowledge of the username and attack vector (/index.lua?pageID=Administration usernameAdmChange, passwordAdmChange1, and passwordAdmChange2 fields).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cyberskr.com/blog/cobham-satcom-250-500.html; https://gist.github.com/CyberSKR/2dfd5dccb20a209ec4d35b2678bac0d4; https://cyberskr.com/blog/cobham-satcom-250-500.html
CVE: CVE-2018-19393
Published: 2019-03-15
Description: Cobham Satcom Sailor 800 and 900 devices contained a vulnerability that allowed for arbitrary writing of content to the system's configuration file. This was exploitable via multiple attack vectors depending on the device's configuration. Further analysis also indicated this vulnerability could be leveraged to achieve a Denial of Service (DoS) condition, where the device would require a factory reset to return to normal operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://cyberskr.com/blog/cobham-satcom-800-900.html; https://gist.github.com/CyberSKR/1ade6d887039465d635e27fcbcc817a3; https://cyberskr.com/blog/cobham-satcom-800-900.html
CVE: CVE-2018-19394
Published: 2019-03-15
Description: Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file, inserting an XSS payload into a relevant field (e.g., Satellite name), and then restoring the malicious configuration file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cyberskr.com/blog/cobham-satcom-800-900.html; https://gist.github.com/CyberSKR/fe21b920c8933867ea262a325d37f03b; https://cyberskr.com/blog/cobham-satcom-800-900.html
CVE: CVE-2019-9831
Published: 2019-03-15
Description: The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46381; https://www.youtube.com/watch?v=FJmZ_FfcdoU; https://www.exploit-db.com/exploits/46381
CVE: CVE-2019-9832
Published: 2019-03-15
Description: The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46445; https://www.youtube.com/watch?v=qwjuY7znZjs; https://www.exploit-db.com/exploits/46445
CVE: CVE-2019-9833
Published: 2019-03-15
Description: The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46443; https://www.exploit-db.com/exploits/46443
CVE: CVE-2019-9834
Published: 2019-03-15
Description: The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/netdata/netdata/issues/5800#issuecomment-510986112; https://www.exploit-db.com/exploits/46545; https://www.youtube.com/watch?v=zSG93yX0B8k
CVE: CVE-2018-20174
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function ui_clip_handle_data() that results in an information leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20175
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contains several Integer Signedness errors that lead to Out-Of-Bounds Reads in the file mcs.c and result in a Denial of Service (segfault).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20176
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain several Out-Of- Bounds Reads in the file secure.c that result in a Denial of Service (segfault).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20177
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in the function rdp_in_unistr() and results in memory corruption and possibly even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20178
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in the function process_demand_active() that results in a Denial of Service (segfault).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20179
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20180
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20181
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2018-20182
Published: 2019-03-15
Description: rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00040.html; http://www.securityfocus.com/bid/106938; https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad85163b65e1
CVE: CVE-2019-9835
Published: 2019-03-15
Description: The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.
CVSS Score: 9.6 (CRITICAL)
References: http://www.securityfocus.com/bid/107440; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-033.txt; http://www.securityfocus.com/bid/107440
CVE: CVE-2018-17882
Published: 2019-03-15
Description: An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://etherscan.io/address/0x4daa9dc438a77bd59e8a43c6d46cbfe84cd04255#code; https://github.com/GreenFoxy/Smart-contract-Vulnerabilities/blob/master/BattleToken.md; https://etherscan.io/address/0x4daa9dc438a77bd59e8a43c6d46cbfe84cd04255#code
CVE: CVE-2018-17955
Published: 2019-03-15
Description: In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection
CVSS Score: 2.2 (LOW)
CWE: CWE-377, CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1117592; https://bugzilla.suse.com/show_bug.cgi?id=1117592
CVE: CVE-2018-17956
Published: 2019-03-15
Description: In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=1117597; https://bugzilla.suse.com/show_bug.cgi?id=1117597
CVE: CVE-2018-18205
Published: 2019-03-15
Description: Topvision CC8800 CMTS C-E devices allow remote attackers to obtain sensitive information via a direct request for /WebContent/startup.tar.gz with userName=admin in a cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.cnvd.org.cn/flaw/show/1420913; https://github.com/pudding2/CC8800-CMTS; http://www.cnvd.org.cn/flaw/show/1420913
CVE: CVE-2018-20106
Published: 2019-03-15
Description: In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-20
References: https://bugzilla.suse.com/show_bug.cgi?id=1114853; https://bugzilla.suse.com/show_bug.cgi?id=1114853
CVE: CVE-2019-5616
Published: 2019-03-15
Description: CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.rapid7.com/2019/03/12/r7-2019-01-circuitwerkes-sicon-8-client-side-authentication-read-only-bypass-cve-2019-5616/; https://blog.rapid7.com/2019/03/12/r7-2019-01-circuitwerkes-sicon-8-client-side-authentication-read-only-bypass-cve-2019-5616/
CVE: CVE-2018-20806
Published: 2019-03-17
Description: Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/lota/phamm/issues/24; https://github.com/lota/phamm/issues/24
CVE: CVE-2018-15509
Published: 2019-03-18
Description: Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://0tkombo.wixsite.com/0tkombo/blog/five9-dos-websocket-access; https://0tkombo.wixsite.com/0tkombo/blog/five9-dos-websocket-access
CVE: CVE-2019-6149
Published: 2019-03-18
Description: An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: http://www.securityfocus.com/bid/107438; https://support.lenovo.com/solutions/LEN-25674; http://www.securityfocus.com/bid/107438
CVE: CVE-2018-0143
Published: 2019-03-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none