deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1449
Published: 2019-11-12
Description: A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate privileges to SYSTEM.To exploit this bug, an attacker would have to run a specially crafted file, aka 'Microsoft Office ClickToRun Security Feature Bypass Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1449; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1449
CVE: CVE-2019-1456
Published: 2019-11-12
Description: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1419.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456; https://www.zerodayinitiative.com/advisories/ZDI-19-986/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456
CVE: CVE-2019-1457
Published: 2019-11-12
Description: A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel Security Feature Bypass'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1457; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1457
CVE: CVE-2010-2488
Published: 2019-11-12
Description: NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://access.redhat.com/security/cve/cve-2010-2488; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584929; https://security-tracker.debian.org/tracker/CVE-2010-2488
CVE: CVE-2010-3438
Published: 2019-11-12
Description: libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438; https://security-tracker.debian.org/tracker/CVE-2010-3438
CVE: CVE-2010-3439
Published: 2019-11-12
Description: It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2010-3439; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=575621; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3439
CVE: CVE-2011-2335
Published: 2019-11-12
Description: A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://bugs.chromium.org/p/chromium/issues/detail?id=81351; https://trac.webkit.org/changeset/80155/webkit; https://bugs.chromium.org/p/chromium/issues/detail?id=81351
CVE: CVE-2019-17330
Published: 2019-11-12
Description: The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-2019-17330; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-17331
Published: 2019-11-12
Description: The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17331; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-17332
Published: 2019-11-12
Description: The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, versions 4.1.0, 4.2.0, 4.2.1, and 4.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17332; http://www.tibco.com/services/support/advisories
CVE: CVE-2010-3095
Published: 2019-11-12
Description: mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. NOTE: this issue exists because of an incomplete fix for CVE-2008-5313.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-59
References: https://access.redhat.com/security/cve/cve-2010-3095; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596403; https://security-tracker.debian.org/tracker/CVE-2010-3095
CVE: CVE-2010-3292
Published: 2019-11-12
Description: The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could allow an attacker to replace certain configuration files (e.g., phishing whitelist) via dns/packet spoofing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-311
References: https://access.redhat.com/security/cve/cve-2010-3292; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596396; https://security-tracker.debian.org/tracker/CVE-2010-3292
CVE: CVE-2010-3299
Published: 2019-11-12
Description: The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://access.redhat.com/security/cve/cve-2010-3299; https://seclists.org/oss-sec/2010/q3/357; https://security-tracker.debian.org/tracker/CVE-2010-3299
CVE: CVE-2011-2334
Published: 2019-11-12
Description: Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://trac.webkit.org/changeset/86005; https://bugs.chromium.org/p/chromium/issues/detail?id=81348; http://trac.webkit.org/changeset/86005
CVE: CVE-2019-14365
Published: 2019-11-12
Description: The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef; https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE: CVE-2019-14366
Published: 2019-11-12
Description: WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef; https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE: CVE-2019-14367
Published: 2019-11-12
Description: Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef; https://github.com/arjunmat/slack-chat/commits/master; https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715ef
CVE: CVE-2019-16898
Published: 2019-11-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-16897. Reason: This candidate is a reservation duplicate of CVE-2019-16897. Notes: All CVE users should reference CVE-2019-16897 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-5695
Published: 2019-11-12
Description: NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in which an attacker with local system and privileged access can incorrectly load Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4860; https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://safebreach.com/Post/NVIDIA-GPU-Display-Drivers-for-Windows-and-GFE-Software-DLL-Preloading-and-Potential-Abuses-CVE-2019-5694-CVE-2019-5695
CVE: CVE-2019-6170
Published: 2019-11-12
Description: A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.
CVSS Score: 6.4 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-27714; https://support.lenovo.com/us/en/product_security/LEN-27714
CVE: CVE-2019-6172
Published: 2019-11-12
Description: A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.
CVSS Score: 6.4 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-27714; https://support.lenovo.com/us/en/product_security/LEN-27714
CVE: CVE-2019-6188
Published: 2019-11-12
Description: The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access.
CVSS Score: 9.8 (CRITICAL)
References: https://support.lenovo.com/us/en/product_security/LEN-27714; https://support.lenovo.com/us/en/product_security/LEN-27714
CVE: CVE-2010-3305
Published: 2019-11-12
Description: Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2010-3305; https://security-tracker.debian.org/tracker/CVE-2010-3305; https://www.exploit-db.com/exploits/15014
CVE: CVE-2010-3440
Published: 2019-11-12
Description: babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-494
References: https://access.redhat.com/security/cve/cve-2010-3440; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=591995; https://security-tracker.debian.org/tracker/CVE-2010-3440
CVE: CVE-2010-3844
Published: 2019-11-12
Description: An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://access.redhat.com/security/cve/cve-2010-3844; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=600130; https://github.com/Ettercap/ettercap/commit/4ef3ede30181eca9add74305ad26dbcb0c3686a0
CVE: CVE-2011-1802
Published: 2019-11-12
Description: WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://trac.webkit.org/changeset/86358; https://bugs.chromium.org/p/chromium/issues/detail?id=78572; http://trac.webkit.org/changeset/86358
CVE: CVE-2011-1803
Published: 2019-11-12
Description: An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: http://trac.webkit.org/changeset/86748; https://bugs.chromium.org/p/chromium/issues/detail?id=82516; http://trac.webkit.org/changeset/86748
CVE: CVE-2017-17224
Published: 2019-11-12
Description: Some Huawei smart phones with versions earlier than Harry-AL00C 9.1.0.206(C00E205R3P1) have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180327-01-hg655m-en; https://fortiguard.com/zeroday/FG-VD-18-017; http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180327-01-hg655m-en
CVE: CVE-2010-3857
Published: 2019-11-12
Description: JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2010-3857; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3857; https://security-tracker.debian.org/tracker/CVE-2010-3857
CVE: CVE-2010-4177
Published: 2019-11-12
Description: mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL server in clear text form via the list of running processes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/97959; https://access.redhat.com/security/cve/cve-2010-4177; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605542
CVE: CVE-2019-5213
Published: 2019-11-12
Description: Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321(C00E320R1P1T8) have an insufficient authentication vulnerability. The system has a logic judge error under certain scenario. Successful exploit could allow the attacker to modify the alarm clock settings after a serious of uncommon operations without unlock the screen lock.
CVSS Score: 2.4 (LOW)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191023-01-smartphone-en
CVE: CVE-2019-5228
Published: 2019-11-12
Description: Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) have a race condition vulnerability. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful exploit could cause malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-787
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-smartphone-en
CVE: CVE-2019-5229
Published: 2019-11-12
Description: P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack, successful exploit could cause malicious code execution.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-345
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-02-smartphone-en
CVE: CVE-2019-5230
Published: 2019-11-13
Description: P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than NEO-AL00D NEO-AL00 9.1.0.321(C786E320R1P1T8) have an improper validation vulnerability. The system does not perform a properly validation of certain input models, an attacker could trick the user to install a malicious application then craft a malformed model, successful exploit could allow the attacker to get and tamper certain output data information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-03-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-03-smartphone-en
CVE: CVE-2019-5231
Published: 2019-11-13
Description: P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. The software incorrectly performs an authorization check when a user attempts to perform certain action. Successful exploit could allow the attacker to update a crafted package.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190930-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190930-01-smartphone-en
CVE: CVE-2019-5233
Published: 2019-11-13
Description: Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. Successful exploitation may cause the attacker to access specific components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-01-smartphone-en
CVE: CVE-2019-5246
Published: 2019-11-13
Description: Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack. Successful exploit could cause DOS or malicious code execution.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-345
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-codeexecution-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-codeexecution-en
CVE: CVE-2019-3648
Published: 2019-11-13
Description: A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-426
References: https://safebreach.com/Post/McAfee-All-Editions-MTP-AVP-MIS-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-3648; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102984; https://safebreach.com/Post/McAfee-All-Editions-MTP-AVP-MIS-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-3648
CVE: CVE-2019-3641
Published: 2019-11-13
Description: Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-285
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10303; https://kc.mcafee.com/corporate/index?page=content&id=SB10303
CVE: CVE-2019-18397
Published: 2019-11-13
Description: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://access.redhat.com/errata/RHSA-2019:4326; https://access.redhat.com/errata/RHSA-2019:4361; https://access.redhat.com/errata/RHSA-2020:0291
CVE: CVE-2019-5279
Published: 2019-11-13
Description: Huawei smart phones Emily-L29C with Versions earlier than 9.1.0.311(C10E2R1P13T8), Versions earlier than 9.1.0.311(C461E2R1P11T8), Versions earlier than 9.1.0.316(C635E2R1P11T8), Versions earlier than 9.1.0.311(C185E2R1P12T8), Versions earlier than 9.1.0.311(C605E2R1P12T8), Versions earlier than 9.1.0.311(C636E7R1P13T8) have an information leakage vulnerability. An attacker tricks the user into installing a malicious application, which can copy specific files to the sdcard, resulting in information leakage.
CVSS Score: 5.5 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191030-02-smartphone-en
CVE: CVE-2019-5282
Published: 2019-11-13
Description: Bastet module of some Huawei smartphones with Versions earlier than Emily-AL00A 9.0.0.182(C00E82R1P21), Versions earlier than Emily-TL00B 9.0.0.182(C01E82R1P21), Versions earlier than Emily-L09C 9.0.0.203(C432E7R1P11), Versions earlier than Emily-L29C 9.0.0.203(C432E7R1P11), Versions earlier than Emily-L29C 9.0.0.202(C185E2R1P12) have a double free vulnerability. An attacker tricks the user into installing a malicious application, which frees on the same memory address twice. Successful exploit could result in malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190220-01-smartphone-en
CVE: CVE-2013-4656
Published: 2019-11-13
Description: Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdf
CVE: CVE-2019-17523
Published: 2019-11-13
Description: An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17524/README.md; https://www.technicolor.com/news; https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17524/README.md
CVE: CVE-2019-17524
Published: 2019-11-13
Description: An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17523/README.md; https://www.technicolor.com/news; https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17523/README.md