deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-17321
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated with session, could leak username via session file path of HTTP response data. No authentication is required.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2019-17322
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-22
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2019-17323
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-91, CWE-91
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2019-17324
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2019-17325
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2019-17326
Published: 2019-10-30
Description: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184
CVE: CVE-2010-0398
Published: 2019-10-30
Description: The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://bugs.launchpad.net/ubuntu/+source/autokey/+bug/538471; https://security-tracker.debian.org/tracker/CVE-2010-0398; https://bugs.launchpad.net/ubuntu/+source/autokey/+bug/538471
CVE: CVE-2018-21029
Published: 2019-10-30
Description: systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://blog.cloudflare.com/dns-encryption-explained/; https://github.com/systemd/systemd/blob/v239/man/resolved.conf.xml#L199-L207; https://github.com/systemd/systemd/blob/v243/man/resolved.conf.xml#L196-L207
CVE: CVE-2019-10762
Published: 2019-10-30
Description: columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/catfan/Medoo/commit/659864b393961bf224bba1efc03b7dcbed7de533; https://snyk.io/vuln/SNYK-PHP-CATFANMEDOO-474562; https://github.com/catfan/Medoo/commit/659864b393961bf224bba1efc03b7dcbed7de533
CVE: CVE-2019-12417
Published: 2019-10-30
Description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2019-18632
Published: 2019-10-30
Description: European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://sec-consult.com/en/blog/advisories/15587/; https://sec-consult.com/en/blog/advisories/15587/
CVE: CVE-2019-18633
Published: 2019-10-30
Description: European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://sec-consult.com/en/blog/advisories/15587/; https://sec-consult.com/en/blog/advisories/15587/
CVE: CVE-2019-18635
Published: 2019-10-30
Description: An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is a NULL pointer dereference in MPDevice_win.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mooltipass/moolticute/pull/483; https://securiteam.io/2019/10/27/a-null-pointer-dereference/; https://github.com/mooltipass/moolticute/pull/483
CVE: CVE-2010-0737
Published: 2019-10-30
Description: A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0737; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0737
CVE: CVE-2010-0747
Published: 2019-10-30
Description: drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://security-tracker.debian.org/tracker/CVE-2010-0747; https://www.debian.org/security/2010/dsa-2015; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573531
CVE: CVE-2010-0748
Published: 2019-10-30
Description: Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0748; https://github.com/transmission/transmission/wiki/Release-Notes#transmission[PII_REDACTED]4; https://security-tracker.debian.org/tracker/CVE-2010-0748
CVE: CVE-2010-0749
Published: 2019-10-30
Description: Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0749; https://github.com/transmission/transmission/wiki/Release-Notes#transmission[PII_REDACTED]4; https://security-tracker.debian.org/tracker/CVE-2010-0749
CVE: CVE-2010-1673
Published: 2019-10-30
Description: A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ikiwiki.info/security/#index37h2; https://security-tracker.debian.org/tracker/CVE-2010-1673; https://ikiwiki.info/security/#index37h2
CVE: CVE-2019-18644
Published: 2019-10-31
Description: The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-367
References: https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Privileged%20File%20Delete/v11.5.2.28/README.md; https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Privileged%20File%20Delete/v11.5.2.28/README.md
CVE: CVE-2019-18645
Published: 2019-10-31
Description: The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Local%20Privilege%20Escalation/v11.5.2.28/README.md; https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Local%20Privilege%20Escalation/v11.5.2.28/README.md
CVE: CVE-2019-17551
Published: 2019-10-31
Description: In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload to /WFS/agreementView.faces allowing a stored XSS via the mainForm:loanNotesnotes:0:rich_text_editor_note_text parameter in the Notes section. Although versions 6.31.8.3 and 6.31.8.5 are confirmed to be affected, all versions with the vulnerable WYSIWYG editor in the Notes section are likely affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.apakgroup.com/products/wholesale-floorplanning-finance/; https://www2.deloitte.com/de/de/pages/risk/articles/wholesale-finance-xss.html; https://www.cybersecurity-help.cz/vdb/SB[PII_REDACTED]?affChecked=1
CVE: CVE-2019-18420
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html; http://www.openwall.com/lists/oss-security/2019/10/31/1; http://xenbits.xen.org/xsa/advisory-296.html
CVE: CVE-2019-18421
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pagetable, and "demoted" before being used for any other type. Xen also allows for "recursive" promotions: i.e., an operating system promoting a page to an L4 pagetable may end up causing pages to be promoted to L3s, which may in turn cause pages to be promoted to L2s, and so on. These operations may take an arbitrarily large amount of time, and so must be re-startable. Unfortunately, making recursive pagetable promotion and demotion operations restartable is incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra type counts, potentially allowing guests to get write access to in-use pagetables. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All x86 systems with untrusted PV guests are vulnerable. HVM and PVH guests cannot exercise this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html; http://www.openwall.com/lists/oss-security/2019/10/31/3; http://xenbits.xen.org/xsa/advisory-299.html
CVE: CVE-2019-18422
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.openwall.com/lists/oss-security/2019/10/31/5; http://xenbits.xen.org/xsa/advisory-303.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
CVE: CVE-2019-18423
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry() will alias the frame. However, p2m->max_mapped_gfn will be updated using the original frame. It would be possible to set p2m->max_mapped_gfn high enough to cover a frame that would lead p2m_get_root_pointer() to return NULL in p2m_get_entry() and p2m_resolve_translation_fault(). Additionally, the sanity check on p2m->max_mapped_gfn is off-by-one allowing "highest mapped + 1" to be considered valid. However, p2m_get_root_pointer() will return NULL. The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen version 4.8 and newer are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-193
References: http://www.openwall.com/lists/oss-security/2019/10/31/4; http://xenbits.xen.org/xsa/advisory-301.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
CVE: CVE-2019-18424
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only target memory assigned to the guest. However, when the guest domain is torn down, or the device is deassigned, the device is assigned back to dom0, thus allowing any in-flight DMA to potentially target critical host data. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html; http://www.openwall.com/lists/oss-security/2019/10/31/6; http://xenbits.xen.org/xsa/advisory-302.html
CVE: CVE-2019-18425
Published: 2019-10-31
Description: An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would allow guest user mode to install and then use descriptors of their choice, as long as the guest kernel did not itself install an LDT. (Most OSes don't install any LDT by default). 32-bit PV guest user mode can elevate its privileges to that of the guest kernel. Xen versions from at least 3.2 onwards are affected. Only 32-bit PV guest user mode can leverage this vulnerability. HVM, PVH, as well as 64-bit PV guests cannot leverage this vulnerability. Arm systems are unaffected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html; http://www.openwall.com/lists/oss-security/2019/10/31/2; http://xenbits.xen.org/xsa/advisory-298.html
CVE: CVE-2018-21030
Published: 2019-10-31
Description: Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-863
References: https://github.com/jupyter/notebook/pull/3341; https://github.com/jupyter/notebook/releases/tag/5.5.0; https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html
CVE: CVE-2019-18360
Published: 2019-10-31
Description: In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18361
Published: 2019-10-31
Description: JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18362
Published: 2019-10-31
Description: JetBrains MPS before 2019.2.2 exposed listening ports to the network.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18363
Published: 2019-10-31
Description: In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18364
Published: 2019-10-31
Description: In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2009-5041
Published: 2019-10-31
Description: overkill has buffer overflow via long player names that can corrupt data on the server machine
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security-tracker.debian.org/tracker/CVE-2009-5041; https://security-tracker.debian.org/tracker/CVE-2009-5041
CVE: CVE-2009-5042
Published: 2019-10-31
Description: python-docutils allows insecure usage of temporary files
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-668
References: https://security-tracker.debian.org/tracker/CVE-2009-5042; https://security-tracker.debian.org/tracker/CVE-2009-5042
CVE: CVE-2009-5043
Published: 2019-10-31
Description: burn allows file names to escape via mishandled quotation marks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://security-tracker.debian.org/tracker/CVE-2009-5043; https://security-tracker.debian.org/tracker/CVE-2009-5043
CVE: CVE-2010-2490
Published: 2019-10-31
Description: Mumble: murmur-server has DoS due to malformed client query
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2010-2490; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2490; https://security-tracker.debian.org/tracker/CVE-2010-2490
CVE: CVE-2019-18365
Published: 2019-10-31
Description: In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18366
Published: 2019-10-31
Description: In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18367
Published: 2019-10-31
Description: In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-18368
Published: 2019-10-31
Description: In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.
CVSS Score: 7.3 (HIGH)
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/