deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15053
Published: 2019-08-14
Description: The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/l0nax/CVE-2019-15053; https://marketplace.atlassian.com/apps/4885/html-include-and-replace-macro?hosting=server&tab=versions; https://github.com/l0nax/CVE-2019-15053
CVE: CVE-2019-3635
Published: 2019-08-14
Description: Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.
CVSS Score: 6.5 (MEDIUM)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10293; https://kc.mcafee.com/corporate/index?page=content&id=SB10293
CVE: CVE-2019-3637
Published: 2019-08-14
Description: Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10291; https://kc.mcafee.com/corporate/index?page=content&id=SB10291
CVE: CVE-2019-3639
Published: 2019-08-14
Description: Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1021
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10293; https://kc.mcafee.com/corporate/index?page=content&id=SB10293
CVE: CVE-2019-9506
Published: 2019-08-14
Description: The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310, CWE-327
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html; http://seclists.org/fulldisclosure/2019/Aug/11
CVE: CVE-2018-19386
Published: 2019-08-14
Description: SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://i.imgur.com/Y7t2AD6.png; https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5; https://i.imgur.com/Y7t2AD6.png
CVE: CVE-2019-12262
Published: 2019-08-14
Description: Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Reverse ARP replies (Logical Flaw).
CVSS Score: 9.8 (CRITICAL)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://support.f5.com/csp/article/K41190253
CVE: CVE-2019-15052
Published: 2019-08-14
Description: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/gradle/gradle/issues/10278; https://github.com/gradle/gradle/pull/10176; https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
CVE: CVE-2019-9582
Published: 2019-08-14
Description: eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15.
CVSS Score: 7.5 (HIGH)
References: https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9582.md; https://psytester.github.io/CVE-2019-9582/; https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9582.md
CVE: CVE-2019-9583
Published: 2019-08-14
Description: eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.
CVSS Score: 8.2 (HIGH)
CWE: CWE-400
References: https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9583.md; https://psytester.github.io/CVE-2019-9583/; https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-03-27-CVE-2019-9583.md
CVE: CVE-2019-0714
Published: 2019-08-14
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0714; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0714
CVE: CVE-2019-0715
Published: 2019-08-14
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0715; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0715
CVE: CVE-2019-0716
Published: 2019-08-14
Description: A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to cause a target system to stop responding.
The update addresses the vulnerability by correcting how Windows handles objects in memory.
CVSS Score: 5.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0716; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0716
CVE: CVE-2019-0717
Published: 2019-08-14
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0717; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0717
CVE: CVE-2019-0718
Published: 2019-08-14
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0718; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0718
CVE: CVE-2019-0720
Published: 2019-08-14
Description: A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.
An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.
The security update addresses the vulnerability by correcting how Windows Hyper-V Network Switch validates guest operating system network traffic.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0720; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0720
CVE: CVE-2019-0723
Published: 2019-08-14
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash.
To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.
The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0723; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0723
CVE: CVE-2019-0736
Published: 2019-08-14
Description: A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client. An attacker who successfully exploited the vulnerability could run arbitrary code on the client machine.
To exploit the vulnerability, an attacker could send specially crafted DHCP responses to a client.
The security update addresses the vulnerability by correcting how Windows DHCP clients handle certain DHCP responses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0736; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0736
CVE: CVE-2019-0965
Published: 2019-08-14
Description: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.
An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.
The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0965; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0965
CVE: CVE-2019-12103
Published: 2019-08-14
Description: The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/; https://www.tp-link.com/uk/support/download/m7350/v3/#Firmware; https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/
CVE: CVE-2019-12104
Published: 2019-08-14
Description: The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/; https://www.tp-link.com/uk/support/download/m7350/v3/#Firmware; https://www.pentestpartners.com/security-blog/cve-2019-12103-analysis-of-a-pre-auth-rce-on-the-tp-link-m7350-with-ghidra/
CVE: CVE-2019-13030
Published: 2019-08-14
Description: eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer.
CVSS Score: 8.2 (HIGH)
CWE: CWE-425
References: https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md; https://psytester.github.io/CVE-2019-13030/; https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md
CVE: CVE-2019-14216
Published: 2019-08-14
Description: An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpvulndb.com/vulnerabilities/9510; https://zeroauth.ltd/blog/2019/08/09/cve-2019-14216-svg-vector-icon-plugin-wordpress-plugin-vulnerable-to-csrf-and-arbitrary-file-upload-leading-to-remote-code-execution/; https://wpvulndb.com/vulnerabilities/9510
CVE: CVE-2019-14526
Published: 2019-08-14
Description: An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/; https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/
CVE: CVE-2019-14527
Published: 2019-08-14
Description: An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/; https://www.bleepingcomputer.com/news/security/4g-router-vulnerabilities-let-attackers-take-full-control/; https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/
CVE: CVE-2019-15058
Published: 2019-08-14
Description: stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934973; https://github.com/nothings/stb/issues/790; https://security-tracker.debian.org/tracker/CVE-2019-15058
CVE: CVE-2019-1030
Published: 2019-08-14
Description: An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.
The update addresses the vulnerability by modifying how Microsoft Edge based on Edge HTML handles objects in memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1030; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1030
CVE: CVE-2019-1057
Published: 2019-08-14
Description: A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the user’s system.
To exploit the vulnerability, an attacker could host a specially crafted website designed to invoke MSXML through a web browser. However, an attacker would have no way to force a user to visit such a website. Instead, an attacker would typically have to convince a user to either click a link in an email message or instant message that would then take the user to the website. When Internet Explorer parses the XML content, an attacker could run malicious code remotely to take control of the user’s system.
The update addresses the vulnerability by correcting how the MSXML parser processes user input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-94
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1057; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1057
CVE: CVE-2019-1078
Published: 2019-08-14
Description: An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.
An authenticated attacker could exploit this vulnerability by running a specially crafted application.
The update addresses the vulnerability by correcting how the Windows Graphics Component handles objects in memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1078; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1078
CVE: CVE-2019-1131
Published: 2019-08-14
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the Chakra scripting engine handles objects in memory.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1131; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1131
CVE: CVE-2019-1133
Published: 2019-08-14
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1133; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1133