deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5264
Published: 2019-12-13
Description: There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition. Successful exploit could cause information disclosure.
CVSS Score: 4.6 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-smartphone-en
CVE: CVE-2019-5277
Published: 2019-12-13
Description: Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-eua-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-eua-en
CVE: CVE-2019-5235
Published: 2019-12-14
Description: Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-01-smartphone-en
CVE: CVE-2019-5252
Published: 2019-12-14
Description: There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-smartphone-en
CVE: CVE-2019-19797
Published: 2019-12-15
Description: read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7XOY5NXUZ6JRBBPYA3CXWGRGQTSDVVG2/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILJM2G6NM5MMBKTT5CH23TAI6DJGNW36/
CVE: CVE-2014-3536
Published: 2019-12-15
Description: CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://access.redhat.com/security/cve/cve-2014-3536; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3536; https://access.redhat.com/security/cve/cve-2014-3536
CVE: CVE-2014-3643
Published: 2019-12-15
Description: jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://access.redhat.com/security/cve/cve-2014-3643; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3643; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2014-3652
Published: 2019-12-15
Description: JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://access.redhat.com/security/cve/cve-2014-3652; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3652; https://access.redhat.com/security/cve/cve-2014-3652
CVE: CVE-2014-3699
Published: 2019-12-15
Description: eDeploy has RCE via cPickle deserialization of untrusted data
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/security/cve/cve-2014-3699; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3699; https://security-tracker.debian.org/tracker/CVE-2014-3699
CVE: CVE-2014-3701
Published: 2019-12-15
Description: eDeploy has tmp file race condition flaws
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://access.redhat.com/security/cve/cve-2014-3701; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3701; https://security-tracker.debian.org/tracker/CVE-2014-3701
CVE: CVE-2014-4913
Published: 2019-12-15
Description: ZF2014-03 has a potential cross site scripting vector in multiple view helpers
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/07/11/4; http://www.securityfocus.com/bid/66971; https://access.redhat.com/security/cve/cve-2014-4913
CVE: CVE-2014-8561
Published: 2019-12-15
Description: imagemagick 6.8.9.6 has remote DOS via infinite loop
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://packetstormsecurity.com/files/128944/ImageMagick-Out-Of-Bounds-Read-Heap-Overflow.html; http://seclists.org/fulldisclosure/2014/Nov/1; http://www.openwall.com/lists/oss-security/2014/10/31/3
CVE: CVE-2014-8650
Published: 2019-12-15
Description: python-requests-Kerberos through 0.5 does not handle mutual authentication
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/11/07/1; http://www.securityfocus.com/bid/70909; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8650
CVE: CVE-2019-19807
Published: 2019-12-15
Description: In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97; https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97
CVE: CVE-2019-19783
Published: 2019-12-16
Description: An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to create any mailbox with administrator privileges, because of folder mishandling in autosieve_createfolder() in imap/lmtp_sieve.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIV4HQ6LG5GPRO4B5Z2NHCZUPBUVVVF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGOO5UGEBBDPN7B2YXLK7I7L3Y35EBA/; https://seclists.org/bugtraq/2019/Dec/38
CVE: CVE-2019-19331
Published: 2019-12-16
Description: knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB).
CVSS Score: 7.5 (HIGH)
CWE: CWE-407, CWE-404
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331; https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html; https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html
CVE: CVE-2019-19368
Published: 2019-12-16
Description: A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155719/Rumpus-FTP-Web-File-Manager-8.2.9.1-Cross-Site-Scripting.html; https://github.com/harshit-shukla/CVE-2019-19368/; https://www.maxum.com/Rumpus/Download.html
CVE: CVE-2019-4444
Published: 2019-12-16
Description: IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163453; https://www.ibm.com/support/pages/node/1126833; https://exchange.xforce.ibmcloud.com/vulnerabilities/163453
CVE: CVE-2019-4560
Published: 2019-12-16
Description: IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poorly formatted messages. IBM X-Force ID: 166357.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166357; https://www.ibm.com/support/pages/node/1106037; https://exchange.xforce.ibmcloud.com/vulnerabilities/166357
CVE: CVE-2019-18826
Published: 2019-12-16
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/clickshare/firmware-update
CVE: CVE-2019-18827
Published: 2019-12-16
Description: On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before handing control over to embedded firmware.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-285, CWE-362
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
CVE: CVE-2019-18828
Published: 2019-12-16
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account (present for access via debug interfaces, which are by default not enabled on production devices) of the embedded Linux on the ClickShare Button is using a weak password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-521
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
CVE: CVE-2019-18830
Published: 2019-12-16
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code execution on the ClickShare Button with the privileges of the user 'nobody'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
CVE: CVE-2019-18831
Published: 2019-12-16
Description: Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a test device-certificate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare/; https://www.barco.com/en/clickshare/firmware-update; https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=09&patchVersion=01&buildVersion=007
CVE: CVE-2019-19731
Published: 2019-12-16
Description: Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.html; http://www.roxyfileman.com/download; http://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.html
CVE: CVE-2019-19743
Published: 2019-12-16
Description: On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
CVSS Score: 6.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2019/Dec/35; https://pastebin.com/wHiRGdEG; https://www.dlink.com/en/security-bulletin
CVE: CVE-2019-0134
Published: 2019-12-16
Description: Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to potentially execute code at an elevated level of privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00230.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00230.html
CVE: CVE-2019-0159
Published: 2019-12-16
Description: Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00237.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00237.html
CVE: CVE-2019-10773
Published: 2019-12-16
Description: In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://access.redhat.com/errata/RHSA-2020:0475; https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/; https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7
CVE: CVE-2019-11096
Published: 2019-12-16
Description: Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00253.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00253.html
CVE: CVE-2019-11157
Published: 2019-12-16
Description: Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K10321239?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00289.html
CVE: CVE-2019-11165
Published: 2019-12-16
Description: Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://support.f5.com/csp/article/K07357521?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00284.html; https://support.f5.com/csp/article/K07357521?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-13533
Published: 2019-12-16
Description: In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294, CWE-294
References: https://www.us-cert.gov/ics/advisories/icsa-19-346-02; https://www.us-cert.gov/ics/advisories/icsa-19-346-02
CVE: CVE-2019-14568
Published: 2019-12-16
Description: Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.f5.com/csp/article/K38424406?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00324.html; https://support.f5.com/csp/article/K38424406?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-14599
Published: 2019-12-16
Description: Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00299.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00299.html
CVE: CVE-2019-14603
Published: 2019-12-16
Description: Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00311.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00311.html
CVE: CVE-2019-14604
Published: 2019-12-16
Description: Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00311.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00311.html
CVE: CVE-2019-14605
Published: 2019-12-16
Description: Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00312.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00312.html
CVE: CVE-2019-14607
Published: 2019-12-16
Description: Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00317.html; https://www.synology.com/security/advisory/Synology_SA_19_42
CVE: CVE-2019-14608
Published: 2019-12-16
Description: Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html
CVE: CVE-2019-14609
Published: 2019-12-16
Description: Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html
CVE: CVE-2019-14610
Published: 2019-12-16
Description: Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html
CVE: CVE-2019-14611
Published: 2019-12-16
Description: Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html
CVE: CVE-2019-14612
Published: 2019-12-16
Description: Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00323.html
CVE: CVE-2019-16779
Published: 2019-12-16
Description: In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-664, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html; https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29
CVE: CVE-2019-18259
Published: 2019-12-16
Description: In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://www.us-cert.gov/ics/advisories/icsa-19-346-02; https://www.us-cert.gov/ics/advisories/icsa-19-346-02
CVE: CVE-2019-18261
Published: 2019-12-16
Description: In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://www.us-cert.gov/ics/advisories/icsa-19-346-03; https://www.us-cert.gov/ics/advisories/icsa-19-346-03
CVE: CVE-2019-18269
Published: 2019-12-16
Description: Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-412
References: https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf; https://www.us-cert.gov/ics/advisories/icsa-19-346-02; https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf
CVE: CVE-2019-18579
Published: 2019-12-16
Description: Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" setting is enabled by default. A local unauthenticated attacker with physical access to a user's system can obtain read or write access to main memory via a DMA attack during platform boot.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-16
References: https://www.dell.com/support/article/SLN319808; https://www.dell.com/support/article/SLN319808