deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13109
Published: 2019-06-30
Description: An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/Exiv2/exiv2/issues/790; https://github.com/Exiv2/exiv2/pull/795; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/
CVE: CVE-2019-13110
Published: 2019-06-30
Description: A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://github.com/Exiv2/exiv2/issues/843; https://github.com/Exiv2/exiv2/pull/844; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE: CVE-2019-13111
Published: 2019-06-30
Description: A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/Exiv2/exiv2/issues/791; https://github.com/Exiv2/exiv2/pull/797; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/
CVE: CVE-2019-13112
Published: 2019-06-30
Description: A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/Exiv2/exiv2/issues/845; https://github.com/Exiv2/exiv2/pull/846; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
CVE: CVE-2019-13113
Published: 2019-06-30
Description: Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/Exiv2/exiv2/issues/841; https://github.com/Exiv2/exiv2/pull/842; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/
CVE: CVE-2019-13114
Published: 2019-06-30
Description: http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html; https://github.com/Exiv2/exiv2/issues/793; https://github.com/Exiv2/exiv2/pull/815
CVE: CVE-2019-13117
Published: 2019-07-01
Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html; http://www.openwall.com/lists/oss-security/2019/11/17/2; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471
CVE: CVE-2019-13118
Published: 2019-07-01
Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html; http://seclists.org/fulldisclosure/2019/Aug/11; http://seclists.org/fulldisclosure/2019/Aug/13
CVE: CVE-2019-12970
Published: 2019-07-01
Description: XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153495/SquirrelMail-1.4.22-Cross-Site-Scripting.html; https://lists.debian.org/debian-lts-announce/2019/08/msg00000.html; https://seclists.org/bugtraq/2019/Jul/0
CVE: CVE-2019-12781
Published: 2019-07-01
Description: An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html; http://www.openwall.com/lists/oss-security/2019/07/01/3
CVE: CVE-2019-13125
Published: 2019-07-01
Description: HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://github.com/Tencent/HaboMalHunter/issues/23; https://github.com/Tencent/HaboMalHunter/issues/23
CVE: CVE-2019-13127
Published: 2019-07-01
Description: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://github.com/jgraph/mxgraph/commit/76e8e2809b622659a9c5ffdc4f19922b7a68cfa3; https://marketplace.atlassian.com/apps/1210933/draw-io-diagrams-for-confluence/version-history; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-032.txt
CVE: CVE-2019-13128
Published: 2019-07-01
Description: An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the IPAddress or Gateway field to SetStaticRouteSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/DIR-823G-v2.pdf
CVE: CVE-2019-13129
Published: 2019-07-01
Description: On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 8080. It is caused by snprintf and inappropriate length handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/morouter_stackoverflow.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/morouter/morouter_stackoverflow.pdf
CVE: CVE-2019-4057
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567.
CVSS Score: 6.7 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156567; https://www.ibm.com/support/docview.wss?uid=ibm10880735; https://exchange.xforce.ibmcloud.com/vulnerabilities/156567
CVE: CVE-2019-4101
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of service. Users that have both EXECUTE on PD_GET_DIAG_HIST and access to the diagnostic directory on the DB2 server can cause the instance to crash. IBM X-Force ID: 158091.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/109021; https://exchange.xforce.ibmcloud.com/vulnerabilities/158091; https://www.ibm.com/support/docview.wss?uid=ibm10880741
CVE: CVE-2019-4102
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158092.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/109026; https://exchange.xforce.ibmcloud.com/vulnerabilities/158092; https://www.ibm.com/support/docview.wss?uid=ibm10880743
CVE: CVE-2019-4154
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 158519.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/109024; https://exchange.xforce.ibmcloud.com/vulnerabilities/158519; https://www.ibm.com/support/docview.wss?uid=ibm10880737
CVE: CVE-2019-4237
Published: 2019-07-01
Description: A Cross-Frame Scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 can allow an attacker to load the vulnerable application inside an HTML iframe tag on a malicious page. IBM X-Force ID: 159419.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159419; https://www.ibm.com/support/docview.wss?uid=ibm10879825; https://exchange.xforce.ibmcloud.com/vulnerabilities/159419
CVE: CVE-2019-4295
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault. IBM X-Force ID: 160758.
CVSS Score: 4.9 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10884840; https://exchange.xforce.ibmcloud.com/vulnerabilities/160758; http://www.ibm.com/support/docview.wss?uid=ibm10884840
CVE: CVE-2019-4296
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: http://www.ibm.com/support/docview.wss?uid=ibm10884844; https://exchange.xforce.ibmcloud.com/vulnerabilities/160759; http://www.ibm.com/support/docview.wss?uid=ibm10884844
CVE: CVE-2019-4297
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-90
References: http://www.ibm.com/support/docview.wss?uid=ibm10884826; https://exchange.xforce.ibmcloud.com/vulnerabilities/160761; http://www.ibm.com/support/docview.wss?uid=ibm10884826
CVE: CVE-2019-4298
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764.
CVSS Score: 7.1 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10884820; https://exchange.xforce.ibmcloud.com/vulnerabilities/160764; http://www.ibm.com/support/docview.wss?uid=ibm10884820
CVE: CVE-2019-4299
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: http://www.ibm.com/support/docview.wss?uid=ibm10884842; https://exchange.xforce.ibmcloud.com/vulnerabilities/160765; http://www.ibm.com/support/docview.wss?uid=ibm10884842
CVE: CVE-2019-4322
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 161202.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/109002; https://exchange.xforce.ibmcloud.com/vulnerabilities/161202; https://www.ibm.com/support/docview.wss?uid=ibm10884444
CVE: CVE-2019-4336
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://www.ibm.com/support/docview.wss?uid=ibm10884848; https://exchange.xforce.ibmcloud.com/vulnerabilities/161411; http://www.ibm.com/support/docview.wss?uid=ibm10884848
CVE: CVE-2019-4337
Published: 2019-07-01
Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: http://www.ibm.com/support/docview.wss?uid=ibm10884850; https://exchange.xforce.ibmcloud.com/vulnerabilities/161412; http://www.ibm.com/support/docview.wss?uid=ibm10884850
CVE: CVE-2019-4357
Published: 2019-07-01
Description: When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,
CVSS Score: 6.7 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10886111; http://www.securityfocus.com/bid/109003; https://exchange.xforce.ibmcloud.com/vulnerabilities/161667
CVE: CVE-2019-4383
Published: 2019-07-01
Description: When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user privileges. IBM X-Force ID: 162165.
CVSS Score: 6.7 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10886111; http://www.securityfocus.com/bid/109003; https://exchange.xforce.ibmcloud.com/vulnerabilities/162165
CVE: CVE-2019-4386
Published: 2019-07-01
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-749
References: http://www.securityfocus.com/bid/109019; https://exchange.xforce.ibmcloud.com/vulnerabilities/162174; https://www.ibm.com/support/docview.wss?uid=ibm10886809
CVE: CVE-2019-4410
Published: 2019-07-01
Description: IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162657.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108993; https://exchange.xforce.ibmcloud.com/vulnerabilities/162657; https://www.ibm.com/support/docview.wss?uid=ibm10888037
CVE: CVE-2016-5235
Published: 2019-07-01
Description: A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K48572812; https://support.f5.com/csp/article/K48572812
CVE: CVE-2016-5236
Published: 2019-07-01
Description: Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K55922302; https://support.f5.com/csp/article/K55922302
CVE: CVE-2019-13131
Published: 2019-07-01
Description: Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/47030; https://www.exploit-db.com/exploits/47030
CVE: CVE-2019-12826
Published: 2019-07-01
Description: A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://dannewitz.ninja/posts/widget-logic-csrf-to-rce; https://plugins.trac.wordpress.org/changeset/2112753/widget-logic; https://wpvulndb.com/vulnerabilities/9403
CVE: CVE-2019-13024
Published: 2019-07-01
Description: Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153504/Centreon-19.04-Remote-Code-Execution.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.6.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04/centreon-19.04.3.html
CVE: CVE-2019-1577
Published: 2019-07-01
Description: Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/109053; https://security.paloaltonetworks.com/CVE-2019-1577; http://www.securityfocus.com/bid/109053
CVE: CVE-2019-1578
Published: 2019-07-01
Description: Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109056; https://security.paloaltonetworks.com/CVE-2019-1578; http://www.securityfocus.com/bid/109056
CVE: CVE-2019-7279
Published: 2019-07-01
Description: Optergy Proton/Enterprise devices have Hard-coded Credentials.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/108686; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-008
CVE: CVE-2019-7280
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session and bypass authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007; https://www.us-cert.gov/ics/advisories/icsa-19-211-02
CVE: CVE-2019-7281
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007; https://www.us-cert.gov/ics/advisories/icsa-19-211-02
CVE: CVE-2019-7666
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007
CVE: CVE-2019-7667
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login information, which can allow the attacker to bypass authentication and have full access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: http://packetstormsecurity.com/files/155262/Prima-FlexAir-Access-Control-2.3.35-Database-Backup-Predictable-Name.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007
CVE: CVE-2019-7668
Published: 2019-07-01
Description: Prima Systems FlexAir devices have Default Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7669
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could allow a remote authenticated attacker to upload and execute malicious applications within the application’s web root with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155270/FlexAir-Access-Control-2.3.38-Command-Injection.html; https://applied-risk.com/labs/advisories; https://www.applied-risk.com/resources/ar-2019-007
CVE: CVE-2019-7670
Published: 2019-07-01
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155271/FlexAir-Access-Control-2.3.38-Remote-Root.html; https://applied-risk.com/labs/advisories; https://www.us-cert.gov/ics/advisories/icsa-19-211-02
CVE: CVE-2019-13133
Published: 2019-07-01
Description: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/fe3066122ef72c82415811d25e9e3fad622c0a99; https://github.com/ImageMagick/ImageMagick/issues/1600
CVE: CVE-2019-13134
Published: 2019-07-01
Description: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/fe3066122ef72c82415811d25e9e3fad622c0a99; https://github.com/ImageMagick/ImageMagick/issues/1600