deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5817
Published: 2019-06-27
Description: Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/943709
CVE: CVE-2019-5818
Published: 2019-06-27
Description: Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/929962
CVE: CVE-2019-5819
Published: 2019-06-27
Description: Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafted string copied to clipboard.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/919356
CVE: CVE-2019-5820
Published: 2019-06-27
Description: Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/919635
CVE: CVE-2019-5821
Published: 2019-06-27
Description: Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/919640
CVE: CVE-2019-5822
Published: 2019-06-27
Description: Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/926105
CVE: CVE-2019-5823
Published: 2019-06-27
Description: Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html; https://crbug.com/930154
CVE: CVE-2019-5824
Published: 2019-06-27
Description: Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html; https://crbug.com/948564
CVE: CVE-2019-5827
Published: 2019-06-27
Description: Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html; https://crbug.com/952406
CVE: CVE-2019-5828
Published: 2019-06-27
Description: Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/956597
CVE: CVE-2019-5829
Published: 2019-06-27
Description: Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/958533
CVE: CVE-2019-5830
Published: 2019-06-27
Description: Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/665766
CVE: CVE-2019-5831
Published: 2019-06-27
Description: Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/950328
CVE: CVE-2019-5832
Published: 2019-06-27
Description: Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/959390
CVE: CVE-2019-5833
Published: 2019-06-27
Description: Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/945067
CVE: CVE-2019-5834
Published: 2019-06-27
Description: Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/962368
CVE: CVE-2019-5835
Published: 2019-06-27
Description: Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/939239
CVE: CVE-2019-5836
Published: 2019-06-27
Description: Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/947342
CVE: CVE-2019-5837
Published: 2019-06-27
Description: Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/918293
CVE: CVE-2019-5838
Published: 2019-06-27
Description: Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/893087
CVE: CVE-2019-5839
Published: 2019-06-27
Description: Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/925614
CVE: CVE-2019-5840
Published: 2019-06-27
Description: Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/951782
CVE: CVE-2019-7225
Published: 2019-06-27
Description: The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/153397/ABB-HMI-Hardcoded-Credentials.html; http://seclists.org/fulldisclosure/2019/Jun/38; http://www.securityfocus.com/bid/108922
CVE: CVE-2019-10177
Published: 2019-06-27
Description: A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/109065; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177; http://www.securityfocus.com/bid/109065
CVE: CVE-2019-3629
Published: 2019-06-27
Description: Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.
CVSS Score: 6.5 (MEDIUM)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10284; https://kc.mcafee.com/corporate/index?page=content&id=SB10284
CVE: CVE-2019-3630
Published: 2019-06-27
Description: Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10284; https://kc.mcafee.com/corporate/index?page=content&id=SB10284
CVE: CVE-2019-3631
Published: 2019-06-27
Description: Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10284; https://kc.mcafee.com/corporate/index?page=content&id=SB10284
CVE: CVE-2019-3632
Published: 2019-06-27
Description: Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10284; https://kc.mcafee.com/corporate/index?page=content&id=SB10284
CVE: CVE-2019-12995
Published: 2019-06-28
Description: Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmentation fault.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/istio/istio.io/pull/4555; https://github.com/istio/istio/issues/15084; https://istio.io/about/notes/
CVE: CVE-2019-12997
Published: 2019-06-28
Description: In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HOST environment variable).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/icon-project/loopchain/issues/231; https://github.com/icon-project/loopchain/issues/231
CVE: CVE-2018-15555
Published: 2019-06-28
Description: On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-662
References: http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Jun/1; http://packetstormsecurity.com/files/153262/Telus-Actiontec-WEB6000Q-Privilege-Escalation.html
CVE: CVE-2019-13012
Published: 2019-06-28
Description: The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00022.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931234#12; https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
CVE: CVE-2018-15520
Published: 2019-06-28
Description: Various Lexmark devices have a Buffer Overflow (issue 2 of 2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://support.lexmark.com/index?page=content&id=TE892; http://support.lexmark.com/index?page=content&id=TE892
CVE: CVE-2019-9846
Published: 2019-06-28
Description: RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97861; https://www.seebug.org/vuldb/ssvid-97861
CVE: CVE-2018-14919
Published: 2019-06-28
Description: LOYTEC LGATE-902 6.3.2 devices allow XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html; http://seclists.org/fulldisclosure/2019/Apr/12; https://seclists.org/fulldisclosure/2019/Apr/12
CVE: CVE-2018-15519
Published: 2019-06-28
Description: Various Lexmark devices have a Buffer Overflow (issue 1 of 2).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://support.lexmark.com/index?page=content&id=TE892; http://support.lexmark.com/index?page=content&id=TE892
CVE: CVE-2019-4269
Published: 2019-06-28
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: http://www.securityfocus.com/bid/109000; https://exchange.xforce.ibmcloud.com/vulnerabilities/160202; https://www-01.ibm.com/support/docview.wss?uid=ibm10884032
CVE: CVE-2019-4369
Published: 2019-06-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2018-14867
Published: 2019-06-28
Description: Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/commits/master; https://github.com/odoo/odoo/issues/32503; https://github.com/odoo/odoo/commits/master
CVE: CVE-2018-14868
Published: 2019-06-28
Description: Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/odoo/odoo/commits/master; https://github.com/odoo/odoo/issues/32507; https://github.com/odoo/odoo/commits/master
CVE: CVE-2018-14885
Published: 2019-06-28
Description: Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/odoo/odoo/commits/master; https://github.com/odoo/odoo/issues/32512; https://github.com/odoo/odoo/commits/master
CVE: CVE-2018-14886
Published: 2019-06-28
Description: The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732
References: https://github.com/odoo/odoo/commits/master; https://github.com/odoo/odoo/issues/32513; https://github.com/odoo/odoo/commits/master
CVE: CVE-2018-14887
Published: 2019-06-28
Description: Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/odoo/odoo/commits/master; https://github.com/odoo/odoo/issues/32511; https://github.com/odoo/odoo/commits/master
CVE: CVE-2018-14916
Published: 2019-06-28
Description: LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html; http://seclists.org/fulldisclosure/2019/Apr/12; https://seclists.org/fulldisclosure/2019/Apr/12
CVE: CVE-2018-14918
Published: 2019-06-28
Description: LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.html; http://seclists.org/fulldisclosure/2019/Apr/12; https://seclists.org/fulldisclosure/2019/Apr/12
CVE: CVE-2018-17170
Published: 2019-06-28
Description: Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://research.hisolutions.com/2019/06/web-vulnerabilities-are-coming-to-the-desktop-template-injections-lead-to-rce-in-teamwire/; https://research.hisolutions.com/2019/06/web-vulnerabilities-are-coming-to-the-desktop-template-injections-lead-to-rce-in-teamwire/
CVE: CVE-2018-17560
Published: 2019-06-28
Description: The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.hisolutions.com/2019/06/web-vulnerabilities-are-coming-to-the-desktop-template-injections-lead-to-rce-in-teamwire/; https://research.hisolutions.com/2019/06/web-vulnerabilities-are-coming-to-the-desktop-template-injections-lead-to-rce-in-teamwire/
CVE: CVE-2018-20807
Published: 2019-06-28
Description: An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730/
CVE: CVE-2018-20808
Published: 2019-06-28
Description: An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/
CVE: CVE-2018-20809
Published: 2019-06-28
Description: A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5. This is not applicable to PCS 8.1RX.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/
CVE: CVE-2018-20810
Published: 2019-06-28
Description: Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX, PPS 5.2RX, or stand-alone devices.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/
CVE: CVE-2018-20811
Published: 2019-06-28
Description: A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43877/