deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-17176
Published: 2019-10-11
Description: Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MortalP0ison/5fd584b4c85fa13281fdc918913446fa; https://gist.github.com/MortalP0ison/5fd584b4c85fa13281fdc918913446fa
CVE: CVE-2017-18638
Published: 2019-10-11
Description: send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf; https://github.com/graphite-project/graphite-web/issues/2008; https://github.com/graphite-project/graphite-web/pull/2499
CVE: CVE-2019-17514
Published: 2019-10-12
Description: library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://bugs.python.org/issue33275; https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L380; https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L405
CVE: CVE-2019-17521
Published: 2019-10-12
Description: An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/Elias-Black/Landing-CMS/issues/8; https://github.com/Elias-Black/Landing-CMS/issues/8
CVE: CVE-2019-17522
Published: 2019-10-12
Description: A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/HotaruCMS/HotaruCMS/blob/1a58334da94511df723bfbe78bba77765df181b1/install/libs/install_tables.php#L383; https://github.com/HotaruCMS/HotaruCMS/issues/101; https://github.com/HotaruCMS/HotaruCMS/blob/1a58334da94511df723bfbe78bba77765df181b1/install/libs/install_tables.php#L383
CVE: CVE-2019-17502
Published: 2019-10-12
Description: Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The process_header_end() function calls boa_atoi(), which ultimately calls atoi() on a NULL pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://hydra.hellug.gr; https://gist.github.com/fxb6476/0b9883a88ff2ca40de46a8469834e16c; http://hydra.hellug.gr
CVE: CVE-2019-17528
Published: 2019-10-12
Description: An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom::SetDefaultSampleSize at Core/Ap4TfhdAtom.h when called from AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp.
CVSS Score: 7.5 (HIGH)
References: https://github.com/TeamSeri0us/pocs/tree/master/bento4; https://github.com/axiomatic-systems/Bento4/issues/432; https://github.com/TeamSeri0us/pocs/tree/master/bento4
CVE: CVE-2019-17529
Published: 2019-10-12
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/bento4; https://github.com/axiomatic-systems/Bento4/issues/430; https://github.com/TeamSeri0us/pocs/tree/master/bento4
CVE: CVE-2019-17530
Published: 2019-10-12
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/bento4; https://github.com/axiomatic-systems/Bento4/issues/431; https://github.com/TeamSeri0us/pocs/tree/master/bento4
CVE: CVE-2019-17531
Published: 2019-10-12
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:4192; https://access.redhat.com/errata/RHSA-2020:0159; https://access.redhat.com/errata/RHSA-2020:0160
CVE: CVE-2019-17532
Published: 2019-10-12
Description: An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rules-processing outage) via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/badnack/wemo_dos; https://github.com/badnack/wemo_dos
CVE: CVE-2019-17533
Published: 2019-10-13
Description: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-908
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856; https://github.com/tbeu/matio/commit/651a8e28099edb5fbb9e4e1d4d3238848f446c9a; https://lists.debian.org/debian-lts-announce/2020/06/msg00037.html
CVE: CVE-2019-17534
Published: 2019-10-13
Description: vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16796; https://github.com/libvips/libvips/commit/ce684dd008532ea0bf9d4a1d89bacb35f4a83f4d; https://github.com/libvips/libvips/compare/v8.8.1...v8.8.2
CVE: CVE-2019-17535
Published: 2019-10-13
Description: Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/GilaCMS/gila/pull/48; https://rastating.github.io/gila-cms-reflected-xss/; https://github.com/GilaCMS/gila/pull/48
CVE: CVE-2019-17536
Published: 2019-10-13
Description: Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-434
References: https://github.com/GilaCMS/gila/pull/49; https://rastating.github.io/gila-cms-upload-filter-bypass-and-rce/; https://github.com/GilaCMS/gila/pull/49
CVE: CVE-2019-17537
Published: 2019-10-13
Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/shi-yang/jnoj/issues/53; https://github.com/shi-yang/jnoj/issues/53
CVE: CVE-2019-17538
Published: 2019-10-13
Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/shi-yang/jnoj/issues/53; https://github.com/shi-yang/jnoj/issues/53
CVE: CVE-2019-17501
Published: 2019-10-14
Description: Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/sinfulz/ef49270e245df050af59cc3dd3eefa6b; https://gist.github.com/sinfulz/ef49270e245df050af59cc3dd3eefa6b
CVE: CVE-2019-17539
Published: 2019-10-14
Description: In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15733; https://github.com/FFmpeg/FFmpeg/commit/8df6884832ec413cf032dfaa45c23b1c7876670c; https://lists.debian.org/debian-lts-announce/2021/01/msg00026.html
CVE: CVE-2019-17540
Published: 2019-10-14
Description: ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15826; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942578; https://github.com/ImageMagick/ImageMagick/compare/7.0.8-53...7.0.8-54
CVE: CVE-2019-17541
Published: 2019-10-14
Description: ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15827; https://github.com/ImageMagick/ImageMagick/commit/39f226a9c137f547e12afde972eeba[PII_REDACTED]; https://github.com/ImageMagick/ImageMagick/compare/7.0.8-54...7.0.8-55
CVE: CVE-2019-17542
Published: 2019-10-14
Description: FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15919; https://github.com/FFmpeg/FFmpeg/commit/02f909dc24b1f05cfbba75077c7707b905e63cd2; https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html
CVE: CVE-2019-17543
Published: 2019-10-14
Description: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941
CVE: CVE-2019-17544
Published: 2019-10-14
Description: libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109; https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44fe4e; https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8
CVE: CVE-2019-17545
Published: 2019-10-14
Description: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00022.html; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178; https://github.com/OSGeo/gdal/commit/148115fcc40f1651a5d15fa34c9a8c528e7147bb
CVE: CVE-2019-17546
Published: 2019-10-14
Description: tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16443; https://github.com/OSGeo/gdal/commit/21674033ee246f698887604c7af7ba1962a40ddf; https://gitlab.com/libtiff/libtiff/commit/4bb584a35f87af42d6cf09d15e9ce8909a839145
CVE: CVE-2019-17547
Published: 2019-10-14
Description: In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16537; https://github.com/ImageMagick/ImageMagick/commit/ecf7c6b288e11e7e7f75387c5e9e93e423b98397; https://github.com/ImageMagick/ImageMagick/compare/7.0.8-51...7.0.8-62
CVE: CVE-2019-17408
Published: 2019-10-14
Description: parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Tardis07/CVE_GO/blob/master/zzzphp_code_execution_v1.7.3.md; https://github.com/Tardis07/CVE_GO/blob/master/zzzphp_code_execution_v1.7.3.md
CVE: CVE-2019-17552
Published: 2019-10-14
Description: An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/idreamsoft/iCMS/issues/77; https://github.com/idreamsoft/iCMS/issues/77
CVE: CVE-2019-17553
Published: 2019-10-14
Description: An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sari3l/cve-test/issues/1; https://github.com/sari3l/cve-test/issues/1
CVE: CVE-2019-17574
Published: 2019-10-14
Description: An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: http://blog.redyops.com/wordpress-plugin-popup-maker/; https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md; https://wpvulndb.com/vulnerabilities/9907
CVE: CVE-2019-4572
Published: 2019-10-14
Description: IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an administrator on the local machine. IBM X-Force ID: 166798.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166798; https://www.ibm.com/support/pages/node/1072042; https://exchange.xforce.ibmcloud.com/vulnerabilities/166798
CVE: CVE-2019-14838
Published: 2019-10-14
Description: A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://access.redhat.com/errata/RHSA-2019:3082; https://access.redhat.com/errata/RHSA-2019:3083; https://access.redhat.com/errata/RHSA-2019:4018
CVE: CVE-2019-14858
Published: 2019-10-14
Description: A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-117, CWE-532, CWE-532
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html; https://access.redhat.com/errata/RHSA-2019:3201
CVE: CVE-2019-16344
Published: 2019-10-14
Description: A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fabiantronc.wordpress.com/2019/10/11/xss-on-scadabr-1-0ce/; https://fabiantronc.wordpress.com/2019/10/11/xss-on-scadabr-1-0ce/
CVE: CVE-2019-17575
Published: 2019-10-14
Description: A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-706
References: https://github.com/kbgsft/vuln-wbce/wiki/Arbitrary-file-upload-vulnerbility-in-WBCE-CMS-1.4.0; https://github.com/kbgsft/vuln-wbce/wiki/Arbitrary-file-upload-vulnerbility-in-WBCE-CMS-1.4.0
CVE: CVE-2019-17579
Published: 2019-10-14
Description: SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SonarSource/sonarqube/commit/2beaf73c2d10dcaaf3949889af53579e7d5aba13; https://github.com/SonarSource/sonarqube/commit/2beaf73c2d10dcaaf3949889af53579e7d5aba13
CVE: CVE-2019-9745
Published: 2019-10-14
Description: CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service (Recognition Update Client Service) via an insecure communication channel (Named Pipe). The data (JSON) sent via this channel is used to import data from CRM software using plugins (.dll files). The plugin to import data from the EXQUISE software (DatasourceExquiseExporter.dll) can be persuaded to start arbitrary programs (including batch files) that are executed using the same privileges as Recognition Update Client Service (NT AUTHORITY\SYSTEM), thus elevating privileges. This occurs because a higher-privileged process executes scripts from a directory writable by a lower-privileged user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/KPN-CISO/CVE-2019-9745/blob/master/README.md; https://www.cloudcti.nl/Site/Security; https://github.com/KPN-CISO/CVE-2019-9745/blob/master/README.md
CVE: CVE-2019-16519
Published: 2019-10-14
Description: ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature in scheduled tasks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://support.eset.com/ca7317/; https://danishcyberdefence.dk/blog/esets-cyber-security; http://support.eset.com/ca7317/
CVE: CVE-2019-17511
Published: 2019-10-14
Description: There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via log_get.php, which could be used to discover the intranet network structure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/dahua966/Routers-vuls; https://github.com/dahua966/Routers-vuls/blob/master/DIR-412/vuls_info.md; https://github.com/dahua966/Routers-vuls
CVE: CVE-2019-17580
Published: 2019-10-14
Description: tonyy dormsystem through 1.3 allows SQL Injection in admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Tooonyy/dormsystem/issues/1; https://github.com/Tooonyy/dormsystem/issues/1
CVE: CVE-2019-17583
Published: 2019-10-14
Description: idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/idreamsoft/iCMS/issues/83; https://github.com/idreamsoft/iCMS/issues/83
CVE: CVE-2019-14225
Published: 2019-10-14
Description: OX App Suite 7.10.1 and 7.10.2 allows SSRF.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html; https://seclists.org/fulldisclosure/2019/Oct/25; http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html
CVE: CVE-2019-14226
Published: 2019-10-14
Description: OX App Suite through 7.10.2 has Insecure Permissions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-281
References: http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html; https://seclists.org/fulldisclosure/2019/Oct/25; http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html
CVE: CVE-2019-14227
Published: 2019-10-14
Description: OX App Suite 7.10.1 and 7.10.2 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html; http://seclists.org/fulldisclosure/2019/Oct/25; http://packetstormsecurity.com/files/154826/Open-Xchange-OX-App-Suite-SSRF-XSS-Information-Disclosure-Access-Controls.html
CVE: CVE-2019-16278
Published: 2019-10-14
Description: Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html; http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html; http://www.nazgul.ch/dev/nostromo_cl.txt
CVE: CVE-2019-16279
Published: 2019-10-14
Description: A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.nazgul.ch/dev/nostromo_cl.txt; https://git.sp0re.sh/sp0re/Nhttpd-exploits; https://sp0re.sh
CVE: CVE-2019-17043
Published: 2019-10-14
Description: An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her privileges to the ones of the "patrol" user by specially crafting a shared library .so file that will be loaded during execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/blogresponder/BMC-Patrol-Agent-local-root-privilege-escalation; https://twitter.com/whira_wr; https://github.com/blogresponder/BMC-Patrol-Agent-local-root-privilege-escalation