deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-14852
Published: 2019-06-03
Description: An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The attack allows for an eavesdropper to capture the communication and decrypt the data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: http://www.orpak.com; http://www.securityfocus.com/bid/108167; https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
CVE: CVE-2017-14853
Published: 2019-06-03
Description: The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command. By tampering with the request, an attacker is able to run shell commands and receive valid output from the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/108167; https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01; https://www.orpak.com
CVE: CVE-2018-5404
Published: 2019-06-03
Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://support.quest.com/kb/288310/cert-coordination-center-report-update; https://www.kb.cert.org/vuls/id/877837/; https://support.quest.com/kb/288310/cert-coordination-center-report-update
CVE: CVE-2018-5405
Published: 2019-06-03
Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with 'user console only' rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html; https://support.quest.com/kb/288310/cert-coordination-center-report-update; https://www.kb.cert.org/vuls/id/877837/
CVE: CVE-2018-5406
Published: 2019-06-03
Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html; https://support.quest.com/kb/288310/cert-coordination-center-report-update; https://www.kb.cert.org/vuls/id/877837/
CVE: CVE-2019-10144
Published: 2019-06-03
Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
CVSS Score: 7.7 (HIGH)
CWE: CWE-250, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144; https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144
CVE: CVE-2019-10145
Published: 2019-06-03
Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
CVSS Score: 7.7 (HIGH)
CWE: CWE-250, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145; https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145
CVE: CVE-2019-10147
Published: 2019-06-03
Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.
CVSS Score: 7.7 (HIGH)
CWE: CWE-250, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10147; https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10147
CVE: CVE-2019-12310
Published: 2019-06-03
Description: ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded 'support' credentials, leading to administrative access of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://exagrid.com/exagrid-products/resources/; https://www.inquisitllc.com/exagrid-directory-traversal-vulnerability-to-support-credential-extraction/; https://exagrid.com/exagrid-products/resources/
CVE: CVE-2019-3567
Published: 2019-06-03
Description: In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder of a malicious binary to a folder with known 'safe' permissions. Under those circumstances osquery will load said malicious executable with SYSTEM permissions. The solution is to migrate installations to the 'Program Files' directory on Windows which restricts unprivileged write access. This issue affects osquery prior to v3.4.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-59
References: https://www.facebook.com/security/advisories/cve-2019-3567; https://www.facebook.com/security/advisories/cve-2019-3567
CVE: CVE-2019-3846
Published: 2019-06-03
Description: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE: CVE-2019-3895
Published: 2019-06-03
Description: An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.
CVSS Score: 8.0 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2019:1683; https://access.redhat.com/errata/RHSA-2019:1742; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3895
CVE: CVE-2019-6740
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ASN.1 parser. When parsing ASN.1 strings, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7472.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-19-253/; https://www.zerodayinitiative.com/advisories/ZDI-19-253/
CVE: CVE-2019-6741
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-601, CWE-601
References: https://www.zerodayinitiative.com/advisories/ZDI-19-254/; https://www.zerodayinitiative.com/advisories/ZDI-19-254/
CVE: CVE-2019-6742
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-358
References: https://www.zerodayinitiative.com/advisories/ZDI-19-255/; https://www.zerodayinitiative.com/advisories/ZDI-19-255/
CVE: CVE-2019-6743
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WebAssembly.Instance method. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7466.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-19-366/; https://www.zerodayinitiative.com/advisories/ZDI-19-366/
CVE: CVE-2019-6746
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7634.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-370/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6747
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7636.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-371/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6748
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7637.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-372/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6749
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7638.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-373/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6750
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7639.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-374/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6751
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7632.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-375/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6752
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7620.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-426/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6753
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Stuff method. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7561.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-427/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6754
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the localFileStorage method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7407.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-428/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6755
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7613.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-429/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6756
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HTML files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7769.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-430/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6757
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7696.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-431/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6758
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7701.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-432/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6759
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7614.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-433/; https://www.foxitsoftware.com/support/security-bulletins.php