deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6190
Published: 2020-02-14
Description: Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-665
References: https://support.lenovo.com/us/en/product_security/LEN-28078; https://exchange.xforce.ibmcloud.com/vulnerabilities/176178; https://support.lenovo.com/us/en/product_security/LEN-28078
CVE: CVE-2019-6193
Published: 2020-02-14
Description: An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-200
References: https://support.lenovo.com/us/en/product_security/LEN-29477; https://support.lenovo.com/us/en/product_security/LEN-29477
CVE: CVE-2019-6194
Published: 2020-02-14
Description: An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://support.lenovo.com/us/en/product_security/LEN-29477; https://support.lenovo.com/us/en/product_security/LEN-29477
CVE: CVE-2019-6195
Published: 2020-02-14
Description: An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-264, CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-29116; https://support.lenovo.com/us/en/product_security/LEN-29116
CVE: CVE-2019-11215
Published: 2020-02-14
Description: In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-362, CWE-732
References: https://0day.love/itop_vulnerabilities_disclosure.pdf; https://www.itophub.io/wiki/page?id=2_6_0:release:change_log; https://0day.love/itop_vulnerabilities_disclosure.pdf
CVE: CVE-2020-8611
Published: 2020-02-14
Description: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020; https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm; https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm
CVE: CVE-2020-8844
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-200/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8845
Published: 2020-02-14
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9358.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-201/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8846
Published: 2020-02-14
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-202/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8847
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9414.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-203/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8848
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9407.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-204/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8849
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-205/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8850
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9415.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-206/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8851
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9406.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-207/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8852
Published: 2020-02-14
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9416.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-208/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8853
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9591.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-209/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8854
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of JPEG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9606.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-210/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8855
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-211/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8856
Published: 2020-02-14
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9640.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-212/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8857
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-20-213/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-8858
Published: 2020-02-14
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability; https://www.zerodayinitiative.com/advisories/ZDI-20-214/; https://www.moxa.com/en/support/support/security-advisory/mgate-5105-mb-eip-series-protocol-gateways-vulnerability
CVE: CVE-2020-8612
Published: 2020-02-14
Description: In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://community.ipswitch.com/s/article/MOVEit-Transfer-Security-Vulnerabilities-Feb-2020; https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm; https://docs.ipswitch.com/MOVEit/Transfer2019_2/ReleaseNotes/en/index.htm#49677.htm
CVE: CVE-2020-8843
Published: 2020-02-14
Description: An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: https://github.com/istio/istio/commits/master; https://istio.io/news/security/; https://istio.io/news/security/istio-security-2020-002/
CVE: CVE-2013-4211
Published: 2020-02-14
Description: A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/27529; http://www.openwall.com/lists/oss-security/2013/08/07/2; http://www.securityfocus.com/bid/61650
CVE: CVE-2020-8594
Published: 2020-02-14
Description: The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://spider-security.co.uk/blog-cve-cve-2020-8594; https://wordpress.org/plugins/ninja-forms/#developers; https://wpvulndb.com/vulnerabilities/10070
CVE: CVE-2019-13965
Published: 2020-02-14
Description: Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0day.love/itop_vulnerabilities_disclosure.pdf; https://www.itophub.io/wiki/page?id=latest%3Arelease%3Achange_log; https://0day.love/itop_vulnerabilities_disclosure.pdf
CVE: CVE-2019-13966
Published: 2020-02-14
Description: In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-2015-6544 (which is only about the dashboard title).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0day.love/itop_vulnerabilities_disclosure.pdf; https://www.itophub.io/wiki/page?id=latest%3Arelease%3Achange_log; https://0day.love/itop_vulnerabilities_disclosure.pdf
CVE: CVE-2019-13967
Published: 2020-02-14
Description: iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the community version.
CVSS Score: 7.5 (HIGH)
References: https://0day.love/itop_vulnerabilities_disclosure.pdf; https://www.itophub.io/wiki/page?id=latest%3Arelease%3Achange_log; https://0day.love/itop_vulnerabilities_disclosure.pdf
CVE: CVE-2019-15592
Published: 2020-02-14
Description: GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://hackerone.com/reports/588876; https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15594
Published: 2020-02-14
Description: GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/; https://hackerone.com/reports/507064; https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
CVE: CVE-2019-4392
Published: 2020-02-14
Description: HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0075661; https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0075661
CVE: CVE-2019-5187
Published: 2020-02-14
Description: An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially crafted TIFF file file can cause an out-of-bounds write, resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0972; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0972
CVE: CVE-2020-6068
Published: 2020-02-14
Description: An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted PNG file can cause an out-of-bounds write, resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-0992; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0992
CVE: CVE-2020-8128
Published: 2020-02-14
Description: An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829, CWE-918
References: https://hackerone.com/reports/660565; https://hackerone.com/reports/660565
CVE: CVE-2020-8129
Published: 2020-02-14
Description: An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/660563; https://hackerone.com/reports/660563