deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16250
Published: 2019-09-11
Description: includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://blog.nintechnet.com/settings-change-and-css-injection-in-wordpress-ocean-extra-plugin/; https://blog.nintechnet.com/settings-change-and-css-injection-in-wordpress-ocean-extra-plugin/
CVE: CVE-2019-16256
Published: 2019-09-12
Description: Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
CVSS Score: 9.8 (CRITICAL)
References: https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile; https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16256
CVE: CVE-2019-16257
Published: 2019-09-12
Description: Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
CVSS Score: 9.8 (CRITICAL)
References: https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile; https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
CVE: CVE-2019-10392
Published: 2019-09-12
Description: Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1534; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10393
Published: 2019-09-12
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 4.2 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10394
Published: 2019-09-12
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 4.2 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10395
Published: 2019-09-12
Description: Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1476; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10396
Published: 2019-09-12
Description: Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10397
Published: 2019-09-12
Description: Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 3.1 (LOW)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURTY-1509; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10398
Published: 2019-09-12
Description: Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1545; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10399
Published: 2019-09-12
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 4.2 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-10400
Published: 2019-09-12
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 4.2 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/09/12/2; https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538; http://www.openwall.com/lists/oss-security/2019/09/12/2
CVE: CVE-2019-16261
Published: 2019-09-12
Description: Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_bits; https://gist.github.com/Shlucus/ab762d6b148f2d2d046c956526a80ddc; http://seclists.org/fulldisclosure/2025/Mar/1
CVE: CVE-2019-16238
Published: 2019-09-12
Description: Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/247-afterlogic-aurora-v8-3-9-build-a3-xss-session-hijack; https://www.sevenlayers.com/index.php/247-afterlogic-aurora-v8-3-9-build-a3-xss-session-hijack
CVE: CVE-2019-3638
Published: 2019-09-12
Description: Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10294; https://kc.mcafee.com/corporate/index?page=content&id=SB10294
CVE: CVE-2019-5956
Published: 2019-09-12
Description: Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/vu/JVNVU93628467/index.html; http://jvn.jp/en/vu/JVNVU93628467/index.html
CVE: CVE-2019-5975
Published: 2019-09-12
Description: DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN62618482/index.html; https://kb.cybozu.support/article/35912; http://jvn.jp/en/jp/JVN62618482/index.html
CVE: CVE-2019-5976
Published: 2019-09-12
Description: Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN62618482/index.html; https://kb.cybozu.support/article/35913; http://jvn.jp/en/jp/JVN62618482/index.html
CVE: CVE-2019-5977
Published: 2019-09-12
Description: Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mail'.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: http://jvn.jp/en/jp/JVN62618482/index.html; https://kb.cybozu.support/article/35915; http://jvn.jp/en/jp/JVN62618482/index.html
CVE: CVE-2019-5978
Published: 2019-09-12
Description: Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the application 'Scheduler'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN62618482/index.html; https://kb.cybozu.support/article/35916; http://jvn.jp/en/jp/JVN62618482/index.html
CVE: CVE-2019-5985
Published: 2019-09-12
Description: Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN43172719/index.html; https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html; http://jvn.jp/en/jp/JVN43172719/index.html
CVE: CVE-2019-5986
Published: 2019-09-12
Description: Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, RS-500KI firmware version Ver.01.00.0070 and earlier, PR-500MI/RT-500MI firmware version Ver.01.01.0014 and earlier, and RS-500MI firmware version Ver.03.01.0019 and earlier, and Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware version Ver.19.01.0005 and earlier, PR-S300SE/RT-S300SE/RV-S340SE firmware version Ver.19.40 and earlier, PR-400NE/RT-400NE/RV-440NE firmware version Ver.7.42 and earlier, PR-400KI/RT-400KI/RV-440KI firmware version Ver.07.00.1010 and earlier, PR-400MI/RT-400MI/RV-440MI firmware version Ver. 07.00.1012 and earlier, PR-500KI/RT-500KI firmware version Ver.01.00.0090 and earlier, and PR-500MI/RT-500MI firmware version Ver.01.01.0011 and earlier) allow remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN43172719/index.html; https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html; http://jvn.jp/en/jp/JVN43172719/index.html
CVE: CVE-2019-5991
Published: 2019-09-12
Description: SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN71877187/index.html; https://kb.cybozu.support/article/35975; http://jvn.jp/en/jp/JVN71877187/index.html
CVE: CVE-2019-5992
Published: 2019-09-12
Description: Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN48981892/index.html; http://jvn.jp/en/jp/JVN48981892/index.html
CVE: CVE-2019-5993
Published: 2019-09-12
Description: Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN92510087/index.html; http://jvn.jp/en/jp/JVN92510087/index.html
CVE: CVE-2019-5996
Published: 2019-09-12
Description: SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN93833849/index.html; http://jvn.jp/en/jp/JVN93833849/index.html
CVE: CVE-2019-6003
Published: 2019-09-12
Description: Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN29343839/index.html; https://www.ec-cube.net/products/detail.php?product_id=1602; http://jvn.jp/en/jp/JVN29343839/index.html
CVE: CVE-2019-6004
Published: 2019-09-12
Description: Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN07679150/index.html; http://onlinesupport.fujixerox.com/processDriverForm.do?ctry_code=SG&lang_code=en&d_lang=en&corp_pid=AWMS2&rts=null&model=ApeosWare+Management+Suite+2&type_id=7&oslist=Windows+10+64bit&lang_list=en; http://jvn.jp/en/jp/JVN07679150/index.html
CVE: CVE-2019-6005
Published: 2019-09-12
Description: Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP.
CVSS Score: 9.8 (CRITICAL)
References: http://jvn.jp/en/jp/JVN17127920/index.html; http://jvn.jp/en/jp/JVN17127920/index.html
CVE: CVE-2019-6007
Published: 2019-09-12
Description: Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://jvn.jp/en/jp/JVN39383894/index.html; http://jvn.jp/en/jp/JVN97845465/index.html; http://jvn.jp/en/jp/JVN39383894/index.html
CVE: CVE-2019-6009
Published: 2019-09-12
Description: Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN74699196/index.html; https://github.com/shirasagi/shirasagi; https://github.com/shirasagi/shirasagi/commit/6016948ea535e51b16535888af13df064a1a15d3
CVE: CVE-2019-11773
Published: 2019-09-12
Description: Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-427
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=549191; https://bugs.eclipse.org/bugs/show_bug.cgi?id=549191
CVE: CVE-2019-11774
Published: 2019-09-12
Description: Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
CVSS Score: 7.4 (HIGH)
CWE: CWE-367, CWE-367
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=549192; https://bugs.eclipse.org/bugs/show_bug.cgi?id=549192
CVE: CVE-2019-14236
Published: 2019-09-12
Description: On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.usenix.org/system/files/woot19-paper_schink.pdf; https://www.usenix.org/system/files/woot19-paper_schink.pdf
CVE: CVE-2019-14237
Published: 2019-09-12
Description: On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://www.usenix.org/system/files/woot19-paper_schink.pdf; https://www.usenix.org/system/files/woot19-paper_schink.pdf
CVE: CVE-2019-11898
Published: 2019-09-12
Description: Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://psirt.bosch.com/Advisory/BOSCH-SA-710832.html; https://psirt.bosch.com/Advisory/BOSCH-SA-710832.html
CVE: CVE-2019-11899
Published: 2019-09-12
Description: An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client installations need to be authorized by the APE administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://psirt.bosch.com/Advisory/BOSCH-SA-844044.html; https://psirt.bosch.com/Advisory/BOSCH-SA-844044.html
CVE: CVE-2019-8069
Published: 2019-09-12
Description: Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://helpx.adobe.com/security/products/flash-player/apsb19-46.html; https://security.gentoo.org/glsa/201911-05; https://helpx.adobe.com/security/products/flash-player/apsb19-46.html
CVE: CVE-2019-8070
Published: 2019-09-12
Description: Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/flash-player/apsb19-46.html; https://security.gentoo.org/glsa/201911-05; https://helpx.adobe.com/security/products/flash-player/apsb19-46.html
CVE: CVE-2019-8076
Published: 2019-09-12
Description: Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/application_manager/apsb19-45.html; https://helpx.adobe.com/security/products/application_manager/apsb19-45.html
CVE: CVE-2019-13530
Published: 2019-09-12
Description: Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). An attacker can use these credentials to login via ftp and upload a malicious firmware.
CVSS Score: 7.2 (HIGH)
CWE: CWE-259, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsma-19-255-01; https://www.us-cert.gov/ics/advisories/icsma-19-255-01
CVE: CVE-2019-13534
Published: 2019-09-12
Description: Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494, CWE-494
References: https://www.us-cert.gov/ics/advisories/icsma-19-255-01; https://www.us-cert.gov/ics/advisories/icsma-19-255-01
CVE: CVE-2019-16275
Published: 2019-09-12
Description: hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: http://www.openwall.com/lists/oss-security/2019/09/12/6; https://lists.debian.org/debian-lts-announce/2019/09/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36G4XAZ644DMHBLKOL4FDSPZVIGNQY6U/
CVE: CVE-2016-10938
Published: 2019-09-13
Description: The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://advisories.dxw.com/advisories/copy-me-vulnerable-to-csrf-allowing-unauthenticated-attacker-to-copy-posts/; https://wordpress.org/plugins/copy-me/#developers; https://wpvulndb.com/vulnerabilities/8706