deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7090
Published: 2019-05-24
Description: Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/flash-player/apsb19-06.html; https://helpx.adobe.com/security/products/flash-player/apsb19-06.html
CVE: CVE-2019-7091
Published: 2019-05-24
Description: ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb19-10.html; https://helpx.adobe.com/security/products/coldfusion/apsb19-10.html
CVE: CVE-2019-7092
Published: 2019-05-24
Description: ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb19-10.html; https://helpx.adobe.com/security/products/coldfusion/apsb19-10.html
CVE: CVE-2019-7093
Published: 2019-05-24
Description: Creative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-11.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-11.html
CVE: CVE-2019-7094
Published: 2019-05-24
Description: Adobe Photoshop CC 19.1.7 and earlier, and 20.0.2 and earlier have a heap corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb19-15.html; https://helpx.adobe.com/security/products/photoshop/apsb19-15.html
CVE: CVE-2019-7095
Published: 2019-05-24
Description: Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/Digital-Editions/apsb19-16.html; https://helpx.adobe.com/security/products/Digital-Editions/apsb19-16.html
CVE: CVE-2019-12345
Published: 2019-05-27
Description: XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/hostel/#developers; https://wpvulndb.com/vulnerabilities/9289; https://wordpress.org/plugins/hostel/#developers
CVE: CVE-2019-12360
Published: 2019-05-27
Description: A stack-based buffer over-read exists in FoFiTrueType::dumpString in fofi/FoFiTrueType.cc in Xpdf 4.01.01. It can, for example, be triggered by sending crafted TrueType data in a PDF document to the pdftops tool. It might allow an attacker to cause Denial of Service or leak memory data into dump content.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41801; https://lists.debian.org/debian-lts-announce/2019/06/msg00002.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJ3GYFINXANXTQEDN5SON47IJA5277RU/
CVE: CVE-2019-12361
Published: 2019-05-27
Description: EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://github.com/coolboy0816/audit/issues/3; https://github.com/coolboy0816/audit/issues/3
CVE: CVE-2019-12362
Published: 2019-05-27
Description: EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/coolboy0816/audit/issues/4; https://github.com/coolboy0816/audit/issues/4
CVE: CVE-2019-12372
Published: 2019-05-28
Description: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/153084/Petraware-pTransformer-ADC-SQL-Injection.html; https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html; http://packetstormsecurity.com/files/153084/Petraware-pTransformer-ADC-SQL-Injection.html
CVE: CVE-2019-12378
Published: 2019-05-28
Description: An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This has been disputed as not an issue
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/108475; https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=95baa60a0da80a0143e3ddd4d3725758b4513825; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J36BIJTKEPUOZKJNHQBUZA47RQONUKOI/
CVE: CVE-2019-12379
Published: 2019-05-28
Description: An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://www.securityfocus.com/bid/108478; https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-next&id=84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac; https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=15b3cd8ef46ad1b100e0d3c7e38774f330726820
CVE: CVE-2019-12380
Published: 2019-05-28
Description: **DISPUTED** An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because “All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.”.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-388
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE: CVE-2019-12381
Published: 2019-05-28
Description: An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: this is disputed because new_ra is never used if it is NULL
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securityfocus.com/bid/108473; https://bugzilla.redhat.com/show_bug.cgi?id=1715501; https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=425aa0e1d[PII_REDACTED]8fa3d4a971168bbaa8515
CVE: CVE-2019-12382
Published: 2019-05-28
Description: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE: CVE-2019-12383
Published: 2019-05-28
Description: Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: http://www.securityfocus.com/bid/108484; https://gitweb.torproject.org/tor-browser.git/commit/?id=cbb04b72c68272c2de42f157d40cd7d29a6b7b55; https://hackerone.com/reports/282748
CVE: CVE-2019-12321
Published: 2019-05-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12317. Reason: This candidate is a reservation duplicate of CVE-2019-12317. Notes: All CVE users should reference CVE-2019-12317 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12395
Published: 2019-05-28
Description: In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN89046645/index.html; https://github.com/webbukkit/dynmap/commit/641f142cd3ccdcbfb04eda3059be22dd9ed93783; https://github.com/webbukkit/dynmap/issues/2474
CVE: CVE-2019-12396
Published: 2019-05-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-5440. Reason: This candidate is a reservation duplicate of CVE-2019-5440. Notes: All CVE users should reference CVE-2019-5440 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-17198
Published: 2019-05-28
Description: Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that parser supports external entities in XML DOCTYPE, which opens Roller up to SSRF / File Enumeration vulnerability. Note that this vulnerability exists even if Roller XML-RPC interface is disable via the Roller web admin UI. Mitigation: There are a couple of ways you can fix this vulnerability: 1) Upgrade to the latest version of Roller, which is now 5.2.2 2) Or, edit the Roller web.xml file and comment out the XML-RPC Servlet mapping as shown below: <!-- <servlet-mapping> <servlet-name>XmlRpcServlet</servlet-name> <url-pattern>/roller-services/xmlrpc</url-pattern> </servlet-mapping> -->
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://www.securityfocus.com/bid/108496; https://lists.apache.org/thread.html/94a36ed9c6241558b1c6181d8dd4ff263be7903abd1d20067d4330d5%40%3Cdev.roller.apache.org%3E; http://www.securityfocus.com/bid/108496
CVE: CVE-2018-13375
Published: 2019-05-28
Description: An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager (with FortiAnalyzer feature enabled).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-18-121; https://fortiguard.com/advisory/FG-IR-18-121
CVE: CVE-2019-0188
Published: 2019-05-28
Description: Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://jvn.jp/en/jp/JVN71498764/index.html; http://www.openwall.com/lists/oss-security/2019/05/24/2; http://www.securityfocus.com/bid/108422
CVE: CVE-2019-5435
Published: 2019-05-28
Description: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
CVSS Score: 3.7 (LOW)
CWE: CWE-131, CWE-190
References: https://curl.haxx.se/docs/CVE-2019-5435.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/; https://security.gentoo.org/glsa/202003-29
CVE: CVE-2019-5436
Published: 2019-05-28
Description: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html; http://www.openwall.com/lists/oss-security/2019/09/11/6
CVE: CVE-2019-5440
Published: 2019-05-28
Description: Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId() generates a password reset token that relies on the PHP uniqid function and consequently depends only on the current server time, which is often visible in an HTTP Date header.
CVSS Score: 8.1 (HIGH)
CWE: CWE-338, CWE-338
References: https://hackerone.com/reports/576504; https://hackerone.com/reports/576504
CVE: CVE-2019-7393
Published: 2019-05-28
Description: A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/May/43; http://www.securityfocus.com/bid/108483
CVE: CVE-2019-7394
Published: 2019-05-28
Description: A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/May/43; http://www.securityfocus.com/bid/108483
CVE: CVE-2018-20008
Published: 2019-05-28
Description: iBall Baton iB-WRB302N20122017 devices have improper access control over the UART interface, allowing physical attackers to discover Wi-Fi credentials (plain text) and the web-console password (base64) via the debugging console.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312, CWE-732
References: https://payatu.com/ibaton-routers-responsible-disclosure/; https://www.iball.co.in/Category/Baton/283; https://payatu.com/ibaton-routers-responsible-disclosure/
CVE: CVE-2019-0221
Published: 2019-05-28
Description: The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html; http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html
CVE: CVE-2019-10965
Published: 2019-05-28
Description: In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/108499; https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01; http://www.securityfocus.com/bid/108499
CVE: CVE-2019-10967
Published: 2019-05-28
Description: In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long file name from the LIST command to the FTP service, which may cause the service to overwrite buffers, leading to remote code execution and escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/108499; https://ics-cert.us-cert.gov/advisories/ICSA-19-148-01; http://www.securityfocus.com/bid/108499
CVE: CVE-2019-5589
Published: 2019-05-28
Description: An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control over the directory in which FortiClientOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious .dll files in that directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://fortiguard.com/advisory/FG-IR-19-060; https://fortiguard.com/advisory/FG-IR-19-060
CVE: CVE-2019-12439
Published: 2019-05-29
Description: bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00015.html; https://access.redhat.com/errata/RHSA-2019:1833
CVE: CVE-2019-4137
Published: 2019-05-29
Description: IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10880375; http://www.securityfocus.com/bid/108533; https://exchange.xforce.ibmcloud.com/vulnerabilities/158333
CVE: CVE-2019-4138
Published: 2019-05-29
Description: IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=ibm10880375; http://www.securityfocus.com/bid/108533; https://exchange.xforce.ibmcloud.com/vulnerabilities/158334
CVE: CVE-2019-4139
Published: 2019-05-29
Description: IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158335.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10883872; http://www.securityfocus.com/bid/108527; https://exchange.xforce.ibmcloud.com/vulnerabilities/158335
CVE: CVE-2019-4184
Published: 2019-05-29
Description: IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158974.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108529; https://exchange.xforce.ibmcloud.com/vulnerabilities/158974; https://www.ibm.com/support/docview.wss?uid=ibm10884604
CVE: CVE-2019-4256
Published: 2019-05-29
Description: IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 159944.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.securityfocus.com/bid/108530; https://exchange.xforce.ibmcloud.com/vulnerabilities/159944; https://www.ibm.com/support/docview.wss?uid=ibm10882968
CVE: CVE-2019-4264
Published: 2019-05-29
Description: IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to not validating or incorrectly validating a certificate. IBM X-Force ID: 160072.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.securityfocus.com/bid/108535; https://exchange.xforce.ibmcloud.com/vulnerabilities/160072; https://www.ibm.com/support/docview.wss?uid=ibm10885464
CVE: CVE-2019-12440
Published: 2019-05-29
Description: The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a; https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149; https://kb.sitecore.net/articles/842902
CVE: CVE-2019-7549
Published: 2019-05-29
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54358; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-9177
Published: 2019-05-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-9218
Published: 2019-05-29
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 1 of 5).
CVSS Score: 9.8 (CRITICAL)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-12165
Published: 2019-05-29
Description: MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. Successful exploit of this vulnerability could allow an attacker to execute arbitrary system commands.
CVSS Score: 9.8 (CRITICAL)
References: https://www.mitel.com/-/media/mitel/pdf/content-entry-pdf/en-security-bulletin-17-0010-004.pdf; https://www.mitel.com/-/media/mitel/pdf/content-entry-pdf/en-security-bulletin-17-0010-004.pdf