deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-8952
Published: 2019-05-13
Description: A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0402bt-cve-2019-8952_security_advisory_vrm_path_traversal.pdf; https://psirt.bosch.com; https://psirt.bosch.com/Advisory/BOSCH-2019-0402.html
CVE: CVE-2019-9618
Published: 2019-05-13
Description: The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2019/Mar/26; http://seclists.org/fulldisclosure/2019/Mar/32; https://wordpress.org/plugins/gracemedia-media-player/#developers
CVE: CVE-2019-12087
Published: 2019-05-14
Description: Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent application. For example, the victim becomes stuck in a launcher with their Secure Folder locked. NOTE: the researcher mentions "the Samsung Security Team considered this issue as no/little security impact.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: https://github.com/fs0c131y/SamsungLocker; https://github.com/fs0c131y/SamsungLocker
CVE: CVE-2019-11336
Published: 2019-05-14
Description: Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886.
CVSS Score: 8.1 (HIGH)
CWE: CWE-532
References: http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html; http://seclists.org/fulldisclosure/2019/Apr/32; http://www.securityfocus.com/bid/108072
CVE: CVE-2018-18800
Published: 2019-05-14
Description: The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/150019/PayPal-Credit-Card-Debit-Card-Payment-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/45728/; http://packetstormsecurity.com/files/150019/PayPal-Credit-Card-Debit-Card-Payment-1.0-SQL-Injection.html
CVE: CVE-2019-6512
Published: 2019-05-14
Description: An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6512; https://wso2.com/security-patch-releases/api-manager; https://www.excellium-services.com/cert-xlm-advisory
CVE: CVE-2019-6514
Published: 2019-05-14
Description: An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6514; https://wso2.com/security-patch-releases/dashboard-server; https://www.excellium-services.com/cert-xlm-advisory
CVE: CVE-2019-6515
Published: 2019-05-14
Description: An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user.
CVSS Score: 5.3 (MEDIUM)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6515; https://wso2.com/security-patch-releases/api-manager; https://www.excellium-services.com/cert-xlm-advisory
CVE: CVE-2019-6516
Published: 2019-05-14
Description: An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6516; https://wso2.com/security-patch-releases/dashboard-server; https://www.excellium-services.com/cert-xlm-advisory
CVE: CVE-2019-8390
Published: 2019-05-14
Description: qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151723/qdPM-9.1-Cross-Site-Scripting.html; http://qdpm.net/download-qdpm-free-project-management; http://sourceforge.net/projects/qdpm
CVE: CVE-2018-11691
Published: 2019-05-14
Description: Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson’s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf; http://www.securityfocus.com/bid/109110; https://www.us-cert.gov/ics/advisories/icsa-19-190-01
CVE: CVE-2019-8391
Published: 2019-05-14
Description: qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151723/qdPM-9.1-Cross-Site-Scripting.html; http://qdpm.net/download-qdpm-free-project-management; http://sourceforge.net/projects/qdpm
CVE: CVE-2019-8404
Published: 2019-05-14
Description: An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html; https://sourceforge.net/projects/webinessinventory/files/; https://www.exploit-db.com/exploits/46405/
CVE: CVE-2019-8923
Published: 2019-05-14
Description: XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/151756/XAMPP-5.6.8-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2019/Feb/43; http://www.securityfocus.com/bid/107168
CVE: CVE-2019-9861
Published: 2019-05-14
Description: Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: http://packetstormsecurity.com/files/152714/ABUS-Secvest-3.01.01-Cryptographic-Issues.html; http://seclists.org/fulldisclosure/2019/May/3; https://seclists.org/bugtraq/2019/May/1
CVE: CVE-2019-11844
Published: 2019-05-14
Description: An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152790/RICOH-SP-4520DN-Printer-HTML-Injection.html; http://packetstormsecurity.com/files/152790/RICOH-SP-4520DN-Printer-HTML-Injection.html
CVE: CVE-2019-11845
Published: 2019-05-14
Description: An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152789/RICOH-SP-4510DN-Printer-HTML-Injection.html; http://packetstormsecurity.com/files/152789/RICOH-SP-4510DN-Printer-HTML-Injection.html
CVE: CVE-2019-11846
Published: 2019-05-14
Description: /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152788/dotCMS-5.1.1-HTML-Injection.html; http://packetstormsecurity.com/files/152788/dotCMS-5.1.1-HTML-Injection.html
CVE: CVE-2018-6885
Published: 2019-05-14
Description: An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticated and leads to access to the asset files with the MicroStrategy user privileges. (This includes the credentials to access the admin dashboard which may lead to RCE.) The path traversal is located in a SOAP request in the web service component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability; https://community.microstrategy.com/s/article/Web-Services-Security-Vulnerability
CVE: CVE-2018-8940
Published: 2019-05-14
Description: ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an attacker to upload a malicious XML file and reference it in the URL of the application, forcing the application to load and parse the malicious XML file, aka an XXE issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://seclists.org/fulldisclosure/2019/May/9; https://seclists.org/fulldisclosure/2019/May/9
CVE: CVE-2019-11419
Published: 2019-05-14
Description: vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone's IMEI. The crash occurs upon receiving a message that contains the replaced emoji.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://packetstormsecurity.com/files/152947/WeChat-7.0.4-Denial-Of-Service.html; https://awakened1712.github.io/hacking/hacking-wechat-dos/; https://www.exploit-db.com/exploits/46853
CVE: CVE-2019-8978
Published: 2019-05-14
Description: An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-362
References: http://packetstormsecurity.com/files/152856/Ellucian-Banner-Web-Tailor-Banner-Enterprise-Identity-Services-Improper-Authentication.html; http://seclists.org/fulldisclosure/2019/May/18; https://ecommunities.ellucian.com/message/252749#252749
CVE: CVE-2018-16656
Published: 2019-05-14
Description: DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://mars-cheng.github.io/blog/2019/CVE-2018-16656; https://mars-cheng.github.io/blog/2019/CVE-2018-16656
CVE: CVE-2019-10916
Published: 2019-05-14
Description: A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf; https://www.us-cert.gov/ics/advisories/ICSA-19-134-08; https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf
CVE: CVE-2019-10917
Published: 2019-05-14
Description: A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-248, CWE-755
References: https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf; https://www.us-cert.gov/ics/advisories/ICSA-19-134-08; https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf
CVE: CVE-2019-10918
Published: 2019-05-14
Description: A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf; https://www.us-cert.gov/ics/advisories/ICSA-19-134-08; https://cert-portal.siemens.com/productcert/pdf/ssa-697412.pdf
CVE: CVE-2019-10919
Published: 2019-05-14
Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/153123/Siemens-LOGO-8-Missing-Authentication.html; http://seclists.org/fulldisclosure/2019/May/45; http://www.securityfocus.com/bid/108382
CVE: CVE-2019-10920
Published: 2019-05-14
Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: http://packetstormsecurity.com/files/153122/Siemens-LOGO-8-Hard-Coded-Cryptographic-Key.html; http://seclists.org/fulldisclosure/2019/May/44; http://www.securityfocus.com/bid/108382
CVE: CVE-2019-10921
Published: 2019-05-14
Description: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known
CVSS Score: 7.5 (HIGH)
CWE: CWE-256, CWE-522
References: http://packetstormsecurity.com/files/153124/Siemens-LOGO-8-Recoverable-Password-Format.html; http://seclists.org/fulldisclosure/2019/May/49; http://www.securityfocus.com/bid/108382
CVE: CVE-2019-10922
Published: 2019-05-14
Description: A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 and newer (All versions). An attacker with network access to affected installations, which are configured without "Encrypted Communication", can execute arbitrary code. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/108398; https://cert-portal.siemens.com/productcert/pdf/ssa-705517.pdf; http://www.securityfocus.com/bid/108398
CVE: CVE-2019-10924
Published: 2019-05-14
Description: A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality, integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/108368; https://cert-portal.siemens.com/productcert/pdf/ssa-102144.pdf; http://www.securityfocus.com/bid/108368
CVE: CVE-2019-11204
Published: 2019-05-14
Description: The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/108347; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-statistics-services-2019-11204
CVE: CVE-2019-11205
Published: 2019-05-14
Description: The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108384; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11205