deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-17040
Published: 2019-09-30
Description: contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog; https://github.com/rsyslog/rsyslog/pull/3875; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/
CVE: CVE-2019-17045
Published: 2019-09-30
Description: Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://syhack.wordpress.com/2019/09/29/ilch-content-management-system-v-2-1-22-vulnerability-disclosure/; https://syhack.wordpress.com/2019/09/29/ilch-content-management-system-v-2-1-22-vulnerability-disclosure/
CVE: CVE-2019-17046
Published: 2019-09-30
Description: Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://syhack.wordpress.com/2019/09/29/ilch-content-management-system-v-2-1-22-insecure-file-upload-lfi-remote-code-execution-critical-vulnerability-disclosure/; https://syhack.wordpress.com/2019/09/29/ilch-content-management-system-v-2-1-22-insecure-file-upload-lfi-remote-code-execution-critical-vulnerability-disclosure/
CVE: CVE-2019-10489
Published: 2019-09-30
Description: Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-10492
Published: 2019-09-30
Description: Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 820, SD 820A, SDM439
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10497
Published: 2019-09-30
Description: Use after free issue occurs If another instance of open for voice_svc node has been called from application without closing the previous one. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10498
Published: 2019-09-30
Description: Buffer overflow scenario if the client sends more than 5 io_vec requests to the server in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-10499
Published: 2019-09-30
Description: Improper validation of read and write index of tx and rx fifo`s before using for data copy from fifo can lead to out-of-bound access. in Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, QCS405, SD 665, SD 675, SD 730, SD 855
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10501
Published: 2019-09-30
Description: Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10506
Published: 2019-09-30
Description: While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained from the user space which could be invalid and thus leads to an undesired behaviour in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10507
Published: 2019-09-30
Description: Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10508
Published: 2019-09-30
Description: Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820A, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10509
Published: 2019-09-30
Description: Device record of the pairing device used after free during ACL disconnection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10510
Published: 2019-09-30
Description: BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 675, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660
CVSS Score: 8.2 (HIGH)
CWE: CWE-476
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10538
Published: 2019-09-30
Description: Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can compromise HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-10539
Published: 2019-09-30
Description: Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA8081, QCA9379, QCS404, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-10540
Published: 2019-09-30
Description: Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MSM8996AU, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCS404, QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-16683
Published: 2019-09-30
Description: An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScript payload executes.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://blog.nirajkhatiwada.com.np/cve-2019-16683-stored-cross-site-scripting/; https://github.com/XOOPS/XoopsCore25/commits/master; https://xoops.org/modules/publisher/
CVE: CVE-2019-16684
Published: 2019-09-30
Description: An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit page, the payload executes.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://blog.nirajkhatiwada.com.np/cve-2019-16684-stored-cross-site-scripting/; https://github.com/XOOPS/XoopsCore25/commits/master; https://xoops.org/modules/publisher/
CVE: CVE-2019-16932
Published: 2019-09-30
Description: A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf; https://wordpress.org/plugins/visualizer/#developers; https://wpvulndb.com/vulnerabilities/9892
CVE: CVE-2019-2252
Published: 2019-09-30
Description: Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2284
Published: 2019-09-30
Description: Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDX24
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-2294
Published: 2019-09-30
Description: Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2333
Published: 2019-09-30
Description: Buffer overflow due to improper validation of buffer size while IPA driver processing to perform read operation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-2341
Published: 2019-09-30
Description: Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/08/05/august-2019-code-aurora-security-bulletin
CVE: CVE-2019-4106
Published: 2019-09-30
Description: IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158099.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158099; https://www.ibm.com/support/pages/node/1073864; https://exchange.xforce.ibmcloud.com/vulnerabilities/158099
CVE: CVE-2019-4109
Published: 2019-09-30
Description: IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 158102.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158102; https://www.ibm.com/support/pages/node/1073864; https://exchange.xforce.ibmcloud.com/vulnerabilities/158102
CVE: CVE-2019-4112
Published: 2019-09-30
Description: IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158105.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158105; https://www.ibm.com/support/pages/node/1073864; https://exchange.xforce.ibmcloud.com/vulnerabilities/158105
CVE: CVE-2019-4115
Published: 2019-09-30
Description: IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158113.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158113; https://www.ibm.com/support/pages/node/1073864; https://exchange.xforce.ibmcloud.com/vulnerabilities/158113
CVE: CVE-2019-4280
Published: 2019-09-30
Description: IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IBM X-Force ID: 160503.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160503; https://www.ibm.com/support/pages/node/957207; https://exchange.xforce.ibmcloud.com/vulnerabilities/160503
CVE: CVE-2019-4304
Published: 2019-09-30
Description: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160950; https://www.ibm.com/support/pages/node/960171; https://exchange.xforce.ibmcloud.com/vulnerabilities/160950
CVE: CVE-2019-4305
Published: 2019-09-30
Description: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-565
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160951; https://www.ibm.com/support/pages/node/960171; https://exchange.xforce.ibmcloud.com/vulnerabilities/160951
CVE: CVE-2019-4423
Published: 2019-09-30
Description: IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162769.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162769; https://www.ibm.com/support/pages/node/957207; https://exchange.xforce.ibmcloud.com/vulnerabilities/162769
CVE: CVE-2019-15810
Published: 2019-09-30
Description: Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/netdisco/netdisco/commit/deb9b62c7f839f5e41aa4d620bcdac5f9321a8a3; https://github.com/netdisco/netdisco/commits/master; https://github.com/netdisco/netdisco/commit/deb9b62c7f839f5e41aa4d620bcdac5f9321a8a3
CVE: CVE-2019-13466
Published: 2019-09-30
Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://support.wdc.com/downloads.aspx?g=907&lang=en; https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities; https://support.wdc.com/downloads.aspx?g=907&lang=en
CVE: CVE-2019-13467
Published: 2019-09-30
Description: Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.
CVSS Score: 5.9 (MEDIUM)
References: https://support.wdc.com/downloads.aspx?g=907&lang=en; https://www.westerndigital.com/support/productsecurity/wdc-19009-sandisk-and-western-digital-ssd-dashboard-vulnerabilities; https://support.wdc.com/downloads.aspx?g=907&lang=en