deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19830
Published: 2019-12-31
Description: The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public (by default) and does not check the caller's identity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md; https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE: CVE-2018-19831
Published: 2019-12-31
Description: The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md; https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE: CVE-2018-19832
Published: 2019-12-31
Description: The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md; https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE: CVE-2018-19833
Published: 2019-12-31
Description: The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md; https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE: CVE-2018-19834
Published: 2019-12-31
Description: The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md; https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE: CVE-2019-12837
Published: 2019-12-31
Description: The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several API endpoints.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-706, CWE-863
References: https://vulnz.avm99963.com/T15; https://vulnz.avm99963.com/T15
CVE: CVE-2019-7751
Published: 2019-12-31
Description: A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files, and possibly remote code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://packetstormsecurity.com/files/151963/MarcomCentral-FusionPro-VDP-Creator-Directory-Traversal.html; https://www.exploit-db.com/exploits/46494; https://packetstormsecurity.com/files/151963/MarcomCentral-FusionPro-VDP-Creator-Directory-Traversal.html
CVE: CVE-2019-9197
Published: 2019-12-31
Description: The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://unity3d.com/security#CVE-2019-9197; https://www.zerodayinitiative.com/advisories/ZDI-19-252/; https://unity3d.com/security#CVE-2019-9197
CVE: CVE-2019-9206
Published: 2019-12-31
Description: PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/151925/PRTG-Network-Monitor-7.1.3.3378-Cross-Site-Scripting.html; https://seclists.org/fulldisclosure/2019/Mar/3; https://packetstormsecurity.com/files/151925/PRTG-Network-Monitor-7.1.3.3378-Cross-Site-Scripting.html
CVE: CVE-2019-9207
Published: 2019-12-31
Description: PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinued.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/151925/PRTG-Network-Monitor-7.1.3.3378-Cross-Site-Scripting.html; https://seclists.org/fulldisclosure/2019/Mar/3; https://packetstormsecurity.com/files/151925/PRTG-Network-Monitor-7.1.3.3378-Cross-Site-Scripting.html
CVE: CVE-2019-9553
Published: 2019-12-31
Description: Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/46495; https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.html
CVE: CVE-2019-9554
Published: 2019-12-31
Description: In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/46496; https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html
CVE: CVE-2019-9556
Published: 2019-12-31
Description: FiberHome an5506-04-f RP2669 devices have XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/151959/Fiberhome-AN5506-04-F-RP2669-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/46498; https://packetstormsecurity.com/files/151959/Fiberhome-AN5506-04-F-RP2669-Cross-Site-Scripting.html
CVE: CVE-2019-9668
Published: 2019-12-31
Description: An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service (daemon crash) via a 0xffff datalen field value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://packetstormsecurity.com/files/152058/robinbhandari-FTP-Remote-Denial-Of-Service.html; https://packetstormsecurity.com/files/152058/robinbhandari-FTP-Remote-Denial-Of-Service.html
CVE: CVE-2019-10227
Published: 2019-12-31
Description: openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://openitcockpit.io/2019/05/21/openitcockpit-3-7-1-released/; https://openitcockpit.io/security/; https://openitcockpit.io/2019/05/21/openitcockpit-3-7-1-released/
CVE: CVE-2019-14466
Published: 2019-12-31
Description: The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings from a cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://github.com/gosa-project/gosa-core/pull/29; https://lists.debian.org/debian-lts-announce/2019/08/msg00039.html; https://github.com/gosa-project/gosa-core/pull/29
CVE: CVE-2019-3984
Published: 2019-12-31
Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.tenable.com/security/research/tra-2019-51; https://www.tenable.com/security/research/tra-2019-51
CVE: CVE-2013-4161
Published: 2019-12-31
Description: gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the security issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113182.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113218.html; https://access.redhat.com/security/cve/cve-2013-4161
CVE: CVE-2013-4357
Published: 2019-12-31
Description: The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00020.html; http://www.openwall.com/lists/oss-security/2013/09/17/4; http://www.openwall.com/lists/oss-security/2013/09/17/8
CVE: CVE-2019-20197
Published: 2019-12-31
Description: In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html; https://code610.blogspot.com/2019/12/postauth-rce-in-latest-nagiosxi.html
CVE: CVE-2004-2776
Published: 2019-12-31
Description: go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarchive parameter.
CVSS Score: 9.8 (CRITICAL)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5572&w=2; http://openwall.com/lists/oss-security/2013/12/12/8; https://github.com/mikaku/Monitorix/issues/30
CVE: CVE-2011-3585
Published: 2019-12-31
Description: Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=742907; https://bugzilla.samba.org/show_bug.cgi?id=7179; https://git.samba.org/?p=cifs-utils.git%3Ba=commitdiff%3Bh=810f7e4e0f2dbcbee0294d9b371071cb08268200
CVE: CVE-2013-7070
Published: 2019-12-31
Description: The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://openwall.com/lists/oss-security/2013/12/12/8; https://github.com/mikaku/Monitorix/commit/ff80441be7089f774448dfe4b49e6fced70e71cb; https://github.com/mikaku/Monitorix/issues/30
CVE: CVE-2013-7071
Published: 2019-12-31
Description: Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2013/12/12/8; https://github.com/mikaku/Monitorix/commit/e86c11593238be6956a67a04d640c65810d50b59; https://github.com/mikaku/Monitorix/issues/30
CVE: CVE-2019-18568
Published: 2019-12-31
Description: Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows; https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows
CVE: CVE-2015-5591
Published: 2019-12-31
Description: SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132667/ZenPhoto-1.4.8-XSS-SQL-Injection-Traversal.html; http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/; http://www.zenphoto.org/news/zenphoto-1.4.9
CVE: CVE-2015-5592
Published: 2019-12-31
Description: Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132667/ZenPhoto-1.4.8-XSS-SQL-Injection-Traversal.html; http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/; http://www.zenphoto.org/news/zenphoto-1.4.9
CVE: CVE-2015-5593
Published: 2019-12-31
Description: The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "<<script></script>script>payload<script></script></script>", or in an image tag, with the payload as the onerror event.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2015/07/18/3; http://www.zenphoto.org/news/zenphoto-1.4.9; https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
CVE: CVE-2015-5595
Published: 2019-12-31
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service (resource consumption).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2015/07/18/3; http://www.zenphoto.org/news/zenphoto-1.4.9; https://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
CVE: CVE-2019-20198
Published: 2019-12-31
Description: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://sourceforge.net/p/ezxml/bugs/20/; https://sourceforge.net/p/ezxml/bugs/20/
CVE: CVE-2019-20199
Published: 2019-12-31
Description: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-476
References: https://sourceforge.net/p/ezxml/bugs/18/; https://sourceforge.net/p/ezxml/bugs/18/
CVE: CVE-2019-20200
Published: 2019-12-31
Description: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the "normalize line endings" feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://sourceforge.net/p/ezxml/bugs/19/; https://sourceforge.net/p/ezxml/bugs/19/
CVE: CVE-2019-20201
Published: 2019-12-31
Description: An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://sourceforge.net/p/ezxml/bugs/16/; https://sourceforge.net/p/ezxml/bugs/16/
CVE: CVE-2019-20202
Published: 2019-12-31
Description: An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-763
References: https://sourceforge.net/p/ezxml/bugs/17/; https://sourceforge.net/p/ezxml/bugs/17/
CVE: CVE-2019-20203
Published: 2020-01-02
Description: The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://github.com/V1n1v131r4/Exploiting-Postie-WordPress-Plugin-/blob/master/README.md; https://postieplugin.com/; https://wordpress.org/plugins/postie/#developers
CVE: CVE-2019-20204
Published: 2020-01-02
Description: The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155973/WordPress-Postie-1.9.40-Cross-Site-Scripting.html; https://github.com/V1n1v131r4/Exploiting-Postie-WordPress-Plugin-/blob/master/README.md; https://postieplugin.com/
CVE: CVE-2019-20205
Published: 2020-01-02
Description: libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://github.com/saitoha/libsixel/issues/127; https://github.com/saitoha/libsixel/issues/127
CVE: CVE-2019-20208
Published: 2020-01-02
Description: dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/blob/v0.5.2/src/isomedia/box_code_3gpp.c#L1100; https://github.com/gpac/gpac/commit/bcfcb3e90476692fe0d2bb532ea8deeb2a77580e; https://github.com/gpac/gpac/issues/1348
CVE: CVE-2019-20213
Published: 2020-01-02
Description: D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-863
References: https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-en-faf1a9a13f3f; https://medium.com/%40s1kr10s/d-link-dir-859-unauthenticated-information-disclosure-es-6540f7f55b03; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146
CVE: CVE-2019-20218
Published: 2020-01-02
Description: selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://github.com/sqlite/sqlite/commit/a6c1a71cde082e09750465d[PII_REDACTED]922e387; https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html; https://lists.debian.org/debian-lts-announce/2020/12/msg00016.html
CVE: CVE-2019-20220
Published: 2020-01-02
Description: In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in.html; https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in.html
CVE: CVE-2019-20221
Published: 2020-01-02
Description: In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in-plugin.html; https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in-plugin.html
CVE: CVE-2019-20222
Published: 2020-01-02
Description: In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in-short.html; https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-in-short.html
CVE: CVE-2019-20223
Published: 2020-01-02
Description: In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-id.html; https://fatihhcelik.blogspot.com/2019/12/support-incident-tracker-xss-id.html
CVE: CVE-2020-5179
Published: 2020-01-02
Description: Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. (In some cases, authentication can be achieved with the comtech password for the comtech account.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://overload.cl/blog/comtech-authenticated-rce-on-comtech-fx-series/; https://sku11army.blogspot.com/2020/01/comtech-authenticated-rce-on-comtech-fx.html; https://overload.cl/blog/comtech-authenticated-rce-on-comtech-fx-series/
CVE: CVE-2013-3935
Published: 2020-01-02
Description: Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822; http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes; http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822
CVE: CVE-2013-3936
Published: 2020-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822; http://docs.opsview.com/doku.php?id=opsview4.4:changes#fixes; http://docs.opsview.com/doku.php?id=opsview-core:changes#opsview_core_20130822
CVE: CVE-2019-10158
Published: 2020-01-02
Description: A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158; https://github.com/infinispan/infinispan/pull/6960; https://github.com/infinispan/infinispan/pull/7025