deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19071
Published: 2019-11-18
Description: A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/torvalds/linux/commit/d563131ef23cbc756026f839a82598c8445bc45f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/
CVE: CVE-2019-19072
Published: 2019-11-18
Description: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-401
References: https://github.com/torvalds/linux/commit/96c5c6e6a5b6db592acae039fed54b5c8844cd35; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3PSDE6PTOTVBK2YTKB2TFQP2SUBVSNF/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PY7LJMSPAGRIKABJPDKQDTXYW3L5RX2T/
CVE: CVE-2019-19073
Published: 2019-11-18
Description: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://github.com/torvalds/linux/commit/853acf7caf10b828102d92d05b5c101666a6142b; https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
CVE: CVE-2019-19074
Published: 2019-11-18
Description: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://github.com/torvalds/linux/commit/728c1e2a05e4b5fc52fab3421dce772a806612a2; https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
CVE: CVE-2019-19075
Published: 2019-11-18
Description: A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8; https://github.com/torvalds/linux/commit/6402939ec86eaf226c8b8ae00ed983936b164908
CVE: CVE-2019-19076
Published: 2019-11-18
Description: A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6; https://git.kernel.org/linus/1d1997db870f[PII_REDACTED]ef7014390ba9e24eb2; https://github.com/torvalds/linux/commit/78beef629fd95be4ed853b2d37b832f766bd96ca
CVE: CVE-2019-19077
Published: 2019-11-18
Description: A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://github.com/torvalds/linux/commit/4a9d46a9fe14401f21df69cea97c62396d5fb053; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19078
Published: 2019-11-18
Description: A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://github.com/torvalds/linux/commit/b8d17e7d93d2beb89e4f34c59996376b8b544792; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4ISVNIC44SOGXTUBCIZFSUNQJ5LRKNZ/
CVE: CVE-2019-19079
Published: 2019-11-18
Description: A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory consumption), aka CID-a21b7f0cff19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3; https://github.com/torvalds/linux/commit/a21b7f0cff1906a93a0130b74713b15a0b36481d; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19080
Published: 2019-11-18
Description: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4; https://github.com/torvalds/linux/commit/8572cea1461a006bce1d06c0c4b[PII_REDACTED]fa4
CVE: CVE-2019-19081
Published: 2019-11-18
Description: A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4; https://github.com/torvalds/linux/commit/8ce39eb5a67aee25d9f05b40b673c95b23502e3e
CVE: CVE-2019-19082
Published: 2019-11-18
Description: Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://github.com/torvalds/linux/commit/104c307147ad379617472dd91a5bcb368d72bd6d; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19083
Published: 2019-11-18
Description: Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.8; https://github.com/torvalds/linux/commit/055e547478a11a6360c7ce05e2afc3e366968a12
CVE: CVE-2018-13257
Published: 2019-11-18
Description: The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/gluxon/CVE-2018-13257; https://github.com/gluxon/CVE-2018-13257
CVE: CVE-2019-14467
Published: 2019-11-18
Description: The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155357/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html; https://seclists.org/fulldisclosure/2019/Nov/13; https://wordpress.org/plugins/social-photo-gallery/#developers
CVE: CVE-2019-17057
Published: 2019-11-18
Description: Footy Tipping Software AFL Web Edition 2019 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.footy.com.au/updates.html; https://www.footy.com.au/updates.html
CVE: CVE-2019-17058
Published: 2019-11-18
Description: Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://blog.contentsecurity.com.au/footy-tipping-software-whitelisting-bypass; https://blog.contentsecurity.com.au/footy-tipping-software-whitelisting-bypass
CVE: CVE-2019-19084
Published: 2019-11-18
Description: In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/OctopusDeploy/Issues/issues/5971; https://github.com/OctopusDeploy/Issues/issues/5971
CVE: CVE-2019-19085
Published: 2019-11-18
Description: A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/OctopusDeploy/Issues/issues/5961; https://github.com/OctopusDeploy/Issues/issues/5961
CVE: CVE-2018-21031
Published: 2019-11-18
Description: Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and can be retrieved from Tautulli. NOTE: Initially, this id was associated with Plex Media Server 1.18.2.2029-36236cc4c as the affected product and version. Further research indicated that Tautulli is the correct affected product.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://forums.plex.tv/t/security-regarding-cve-2018-21031/493286; https://twitter.com/GerardFuguet/status/[PII_REDACTED]73912576; https://www.elladodelmal.com/2018/08/shodan-es-de-cine-hacking-tautulli-un.html
CVE: CVE-2019-10172
Published: 2019-11-18
Description: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172; https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E; https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E
CVE: CVE-2019-19113
Published: 2019-11-18
Description: main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/newbee-ltd/newbee-mall/issues/1; https://github.com/newbee-ltd/newbee-mall/issues/1
CVE: CVE-2011-5330
Published: 2019-11-18
Description: Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exploit-db.com/exploits/17031; https://www.exploit-db.com/exploits/17031
CVE: CVE-2011-5331
Published: 2019-11-18
Description: Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
CVSS Score: 9.8 (CRITICAL)
References: https://www.exploit-db.com/exploits/17058; https://www.exploit-db.com/exploits/17058
CVE: CVE-2019-5101
Published: 2019-11-18
Description: An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request. After an SSL connection is initialized via _ustream_ssl_init, and after any data (e.g. the client's HTTP request) is written to the stream using ustream_printf, the code eventually enters the function _ustream_ssl_poll, which is used to dispatch the read/write events
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
CVE: CVE-2019-5102
Published: 2019-11-18
Description: An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
CVE: CVE-2019-5688
Published: 2019-11-18
Description: NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of other devices not managed by NVIDIA, which may lead to escalation of privileges, information disclosure, or denial of service.
CVSS Score: 6.7 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4928; https://nvidia.custhelp.com/app/answers/detail/a_id/4928
CVE: CVE-2018-20687
Published: 2019-11-18
Description: An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html; http://seclists.org/fulldisclosure/2019/Nov/11; http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html
CVE: CVE-2019-12271
Published: 2019-11-18
Description: Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155355/Centraleyezer-Shell-Upload.html; https://link.medium.com/Y2S4ZJbMy1; http://packetstormsecurity.com/files/155355/Centraleyezer-Shell-Upload.html
CVE: CVE-2019-12299
Published: 2019-11-18
Description: Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2019/Nov/8; https://medium.com/insidersec0x42/centraleyezer-stored-xss-using-html-entities-cve-2019-12299-5c295ae54ef; http://seclists.org/fulldisclosure/2019/Nov/8
CVE: CVE-2019-12311
Published: 2019-11-18
Description: Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2019/Nov/9; https://medium.com/insidersec0x42/centraleyezer-unrestricted-file-upload-cve-2019-12311-7cad12e95165; http://seclists.org/fulldisclosure/2019/Nov/9
CVE: CVE-2019-3423
Published: 2019-11-18
Description: permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can construct a URL for directory traversal and access to other unauthorized files or resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011842; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011842
CVE: CVE-2019-3424
Published: 2019-11-18
Description: authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can automatically obtain access to web services from the authorized browser of the same computer and perform operations.
CVSS Score: 8.2 (HIGH)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011842; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011842
CVE: CVE-2019-10763
Published: 2019-11-18
Description: pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://blog.certimetergroup.com/it/articolo/security/sql_injection_in_pimcore_6.2.3; https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-480391; https://blog.certimetergroup.com/it/articolo/security/sql_injection_in_pimcore_6.2.3
CVE: CVE-2019-18215
Published: 2019-11-18
Description: An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerability allows an attacker to implant an unsigned DLL named iLog.dll in a partially unprotected product directory. This DLL is then loaded into a high-privileged service before the binary signature validation logic is loaded, and might bypass some of the self-defense mechanisms.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://forums.comodo.com/news-announcements-feedback-cis/comodo-internet-security-2019-v12106914-released-t124993.0.html; https://safebreach.com/Post/Comodo-Internet-Security-DLL-Preloading-and-Potential-Abuses-CVE-2019-18215; https://safebreach.com/blog
CVE: CVE-2012-4438
Published: 2019-11-18
Description: Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/09/21/2; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4438; https://security-tracker.debian.org/tracker/CVE-2012-4438
CVE: CVE-2012-4439
Published: 2019-11-18
Description: Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/09/21/2; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4439; https://security-tracker.debian.org/tracker/CVE-2012-4439
CVE: CVE-2019-10070
Published: 2019-11-18
Description: Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221%40%3Cdev.atlas.apache.org%3E; https://lists.apache.org/thread.html/cc21437c4c5053a13e13332d614d5172f39da03491fe17ae260be221%40%3Cdev.atlas.apache.org%3E
CVE: CVE-2019-12403
Published: 2019-11-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-12409
Published: 2019-11-18
Description: The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-12409-RCE%20Vulnerability%20Due%20to%20Bad%20Defalut%20Config-Apache%20Solr; https://lists.apache.org/thread.html/47e112035b4aa67ece3b75dbcd1b9c9212895b9dfe2a71f6f7c174e2%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/6640c7e370fce2b74e466a605a46244ccc40666ad9e3064a4e04a85d%40%3Csolr-user.lucene.apache.org%3E