deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0186
Published: 2019-04-26
Description: The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mail-archives.apache.org/mod_mbox/portals-pluto-user/201904.mbox/%3CCAAqbB_ev=0KNgZmmNAq2=q11i1GYLGN6J-xCKx8Q8dbxZ4tZYg%40mail.gmail.com%3E; http://packetstormsecurity.com/files/152642/Apache-Pluto-3.0.0-3.0.1-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/108091
CVE: CVE-2018-18509
Published: 2019-04-26
Description: A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. This vulnerability affects Thunderbird < 60.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html; http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html; http://seclists.org/fulldisclosure/2019/Apr/38
CVE: CVE-2018-18510
Published: 2019-04-26
Description: The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. This vulnerability affects Firefox < 64.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1507702; https://www.mozilla.org/security/advisories/mfsa2018-29/; https://bugzilla.mozilla.org/show_bug.cgi?id=1507702
CVE: CVE-2018-18511
Published: 2019-04-26
Description: Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
CVE: CVE-2018-18512
Published: 2019-04-26
Description: A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although the sound is still being played asynchronously, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1482659; https://www.mozilla.org/security/advisories/mfsa2019-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1482659
CVE: CVE-2018-18513
Published: 2019-04-26
Description: A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) attack because Thunderbird reopens the last seen message on restart, triggering the crash again. This vulnerability affects Thunderbird < 60.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1533300; https://www.mozilla.org/security/advisories/mfsa2019-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1533300
CVE: CVE-2018-5124
Published: 2019-04-26
Description: Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/; https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/
CVE: CVE-2019-9788
Published: 2019-04-26
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1518001%2C1521304%2C1521214%2C1506665%2C1516834%2C1518774%2C1524755%2C1523362%2C1524214%2C1529203
CVE: CVE-2019-9789
Published: 2019-04-26
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1520483%2C1522987%2C1528199%2C1519337%2C1525549%2C1516179%2C1518524%2C1518331%2C1526579%2C1512567%2C1524335%2C1448505%2C1518821; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1520483%2C1522987%2C1528199%2C1519337%2C1525549%2C1516179%2C1518524%2C1518331%2C1526579%2C1512567%2C1524335%2C1448505%2C1518821
CVE: CVE-2019-9790
Published: 2019-04-26
Description: A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1525145
CVE: CVE-2019-9791
Published: 2019-04-26
Description: The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1530958
CVE: CVE-2019-9792
Published: 2019-04-26
Description: The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/153106/Spidermonkey-IonMonkey-JS_OPTIMIZED_OUT-Value-Leak.html; https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144
CVE: CVE-2019-9793
Published: 2019-04-26
Description: A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1528829
CVE: CVE-2019-9794
Published: 2019-04-26
Description: A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1530103; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://www.mozilla.org/security/advisories/mfsa2019-08/
CVE: CVE-2019-9795
Published: 2019-04-26
Description: A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-617, CWE-843
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1514682
CVE: CVE-2019-9796
Published: 2019-04-26
Description: A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1531277
CVE: CVE-2019-9797
Published: 2019-04-26
Description: Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
CVE: CVE-2019-9798
Published: 2019-04-26
Description: On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to that location and loaded. *Note: This issue only affects Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.
CVSS Score: 7.4 (HIGH)
CWE: CWE-426
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1527534; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1527534
CVE: CVE-2019-9799
Published: 2019-04-26
Description: Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent process under certain conditions. This vulnerability affects Firefox < 66.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1505678; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1505678
CVE: CVE-2019-9801
Published: 2019-04-26
Description: Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1527717; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://www.mozilla.org/security/advisories/mfsa2019-08/
CVE: CVE-2019-9802
Published: 2019-04-26
Description: If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data. This vulnerability affects Firefox < 66.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1415508; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1415508
CVE: CVE-2019-9803
Published: 2019-04-26
Description: The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.
CVSS Score: 7.4 (HIGH)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1437009; https://bugzilla.mozilla.org/show_bug.cgi?id=1515863; https://w3c.github.io/webappsec-upgrade-insecure-requests/
CVE: CVE-2019-9804
Published: 2019-04-26
Description: In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. *Note: This issue only affects macOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1518026; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1518026
CVE: CVE-2019-9805
Published: 2019-04-26
Description: A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption. This vulnerability affects Firefox < 66.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1521360; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1521360
CVE: CVE-2019-9806
Published: 2019-04-26
Description: A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack. This vulnerability affects Firefox < 66.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1525267; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1525267
CVE: CVE-2019-9807
Published: 2019-04-26
Description: When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks. This vulnerability affects Firefox < 66.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1362050; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1362050
CVE: CVE-2019-9808
Published: 2019-04-26
Description: If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 66.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1434634; https://www.mozilla.org/security/advisories/mfsa2019-07/; https://bugzilla.mozilla.org/show_bug.cgi?id=1434634
CVE: CVE-2019-9809
Published: 2019-04-26
Description: If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack. This vulnerability affects Firefox < 66.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1282430; https://bugzilla.mozilla.org/show_bug.cgi?id=1523249; https://www.mozilla.org/security/advisories/mfsa2019-07/
CVE: CVE-2019-9810
Published: 2019-04-26
Description: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html; https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144
CVE: CVE-2019-9813
Published: 2019-04-26
Description: Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://access.redhat.com/errata/RHSA-2019:0966; https://access.redhat.com/errata/RHSA-2019:1144; https://bugzilla.mozilla.org/show_bug.cgi?id=1538006
CVE: CVE-2019-11219
Published: 2019-04-26
Description: The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.
CVSS Score: 8.2 (HIGH)
CWE: CWE-330
References: https://hacked.camera/; https://hacked.camera/
CVE: CVE-2019-11220
Published: 2019-04-26
Description: An authentication flaw in Shenzhen Yunni Technology iLnkP2P allows remote attackers to actively intercept user-to-device traffic in cleartext, including video streams and device credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://hacked.camera/; https://hacked.camera/
CVE: CVE-2019-2725
Published: 2019-04-26
Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html; http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-3705
Published: 2019-04-26
Description: Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the webserver or execute arbitrary code on the system with privileges of the webserver by sending specially crafted input data to the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en; https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE: CVE-2019-3706
Published: 2019-04-26
Description: Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted data to the iDRAC web interface.
CVSS Score: 8.6 (HIGH)
References: https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en; https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE: CVE-2019-3707
Published: 2019-04-26
Description: Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to bypass authentication and gain access to the system by sending specially crafted input data to the WS-MAN interface.
CVSS Score: 8.6 (HIGH)
References: https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en; https://www.dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en
CVE: CVE-2019-6689
Published: 2019-04-26
Description: An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers (TJB) parameters. NOTE: this vulnerability exists because the CVE-2014-3272 solution did not address AIX operating systems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://ashsecurity.wordpress.com/2019/04/25/an-improper-cisco-fix-for-cve-2014-3272/; https://ashsecurity.wordpress.com/2019/04/25/an-improper-cisco-fix-for-cve-2014-3272/
CVE: CVE-2018-15580
Published: 2019-04-26
Description: Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4182a3e8b74f6eb325c45862f8f26e76; https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4182a3e8b74f6eb325c45862f8f26e76
CVE: CVE-2018-15581
Published: 2019-04-26
Description: Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4280d95d6643b5d[PII_REDACTED]ada210b; https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13#diff-4280d95d6643b5d[PII_REDACTED]ada210b