deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7843
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7846
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7847
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7848
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 7.5 (HIGH)
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7850
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7941
Published: 2019-07-18
Description: Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://helpx.adobe.com/security/products/campaign/apsb19-28.html; https://helpx.adobe.com/security/products/campaign/apsb19-28.html
CVE: CVE-2019-7953
Published: 2019-07-18
Description: Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html
CVE: CVE-2019-7954
Published: 2019-07-18
Description: Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html
CVE: CVE-2019-7955
Published: 2019-07-18
Description: Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-38.html
CVE: CVE-2019-7956
Published: 2019-07-18
Description: Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Privilege Escalation in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/dreamweaver/apsb19-40.html; https://helpx.adobe.com/security/products/dreamweaver/apsb19-40.html
CVE: CVE-2019-7963
Published: 2019-07-18
Description: Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb19-37.html; https://helpx.adobe.com/security/products/bridge/apsb19-37.html
CVE: CVE-2019-13969
Published: 2019-07-19
Description: Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/zhuxianjin/vuln_repo/blob/master/Metinfo%206.x%20Background%20SQL%20injection.md; https://github.com/zhuxianjin/vuln_repo/blob/master/Metinfo%206.x%20Background%20SQL%20injection.md
CVE: CVE-2019-13970
Published: 2019-07-19
Description: In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AntSwordProject/antSword/commit/4b932e81447b4b0475f4fce[PII_REDACTED]5c249d3; https://github.com/AntSwordProject/antSword/compare/ed01dea...834063a; https://github.com/AntSwordProject/antSword/issues/151
CVE: CVE-2019-13971
Published: 2019-07-19
Description: OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cisk123456.blogspot.com/2019/05/otcms-xss.html; https://cisk123456.blogspot.com/2019/05/otcms-xss.html
CVE: CVE-2019-13972
Published: 2019-07-19
Description: LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE: CVE-2019-13973
Published: 2019-07-19
Description: LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE: CVE-2019-13974
Published: 2019-07-19
Description: LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE: CVE-2019-13977
Published: 2019-07-19
Description: index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153737/Ovidentia-8.4.3-Cross-Site-Scripting.html; https://github.com/Kitsun3Sec/exploits/blob/master/cms/ovidentia/exploitXSSOvidentia.txt; http://packetstormsecurity.com/files/153737/Ovidentia-8.4.3-Cross-Site-Scripting.html
CVE: CVE-2019-13978
Published: 2019-07-19
Description: Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/153738/Ovidentia-8.4.3-SQL-Injection.html; https://github.com/Kitsun3Sec/exploits/blob/master/cms/ovidentia/exploitSQLIOvidentia.txt; http://packetstormsecurity.com/files/153738/Ovidentia-8.4.3-SQL-Injection.html
CVE: CVE-2019-13648
Published: 2019-07-19
Description: In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html; http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://gist.github.com/Lz1y/24a6368c7ffdc1af7292035dd16a97f5; https://gist.github.com/Lz1y/24a6368c7ffdc1af7292035dd16a97f5
CVE: CVE-2019-11552
Published: 2019-07-19
Description: Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.
CVSS Score: 7.0 (HIGH)
CWE: CWE-94
References: https://bordplate.no/blog/en/post/crashplan-privilege-escalation/; https://code42.com/r/support/CVE-2019-11552; https://bordplate.no/blog/en/post/crashplan-privilege-escalation/
CVE: CVE-2019-12946
Published: 2019-07-19
Description: Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://blog.contentsecurity.com.au/security-advisory-elcom-cms-sql-injection; https://blog.contentsecurity.com.au/security-advisory-elcom-cms-sql-injection
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-78
References: https://drive.google.com/open?id=1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv; https://gerrit.onosproject.org/#/c/20767/; https://drive.google.com/open?id=1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zmartzone/mod_auth_openidc/commit/132a4111bf3791e76437619a66336dce2ce4c79b; https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.3.10.2; https://lists.debian.org/debian-lts-announce/2019/08/msg00029.html
CVE: CVE-2019-13979
Published: 2019-07-19
Description: In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/directus/api/issues/979; https://github.com/directus/api/projects/42; https://github.com/directus/api/issues/979
CVE: CVE-2019-13980
Published: 2019-07-19
Description: In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code execution with nginx.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/directus/api/issues/979; https://github.com/directus/api/issues/979
CVE: CVE-2019-13981
Published: 2019-07-19
Description: In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/directus/api/issues/986; https://github.com/directus/api/issues/987; https://github.com/directus/api/issues/986
CVE: CVE-2019-13982
Published: 2019-07-19
Description: interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/directus/app/commit/f010b49eef1526fe0882078bb4a07688e8cc92c1; https://github.com/directus/app/commit/f010b49eef1526fe0882078bb4a07688e8cc92c1
CVE: CVE-2019-13983
Published: 2019-07-19
Description: Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/directus/api/issues/991; https://github.com/directus/api/projects/43; https://github.com/directus/api/issues/991
CVE: CVE-2019-13984
Published: 2019-07-19
Description: Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/directus/api/issues/981; https://github.com/directus/api/projects/44; https://github.com/directus/api/issues/981
CVE: CVE-2019-1167
Published: 2019-07-19
Description: A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
CVSS Score: 4.1 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1167; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1167
CVE: CVE-2015-7882
Published: 2019-07-19
Description: Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://jira.mongodb.org/browse/SERVER-20691; https://jira.mongodb.org/browse/SERVER-20691
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables (ALL executables on the web site). The attack vector is: CAPEC-471, CWE-426, CWE-427.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-427
References: http://seclists.org/oss-sec/2018/q2/146; http://seclists.org/oss-sec/2018/q2/146
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component is: Executable installer, portable executable (ALL executables available). The attack vector is: CWE-29, CWE-377, CWE-379.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://seclists.org/oss-sec/2018/q2/146; http://seclists.org/oss-sec/2018/q2/146
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing; https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only authenticaed users. The attack vector is: Remote.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.exploit-db.com/exploits/45187/; https://www.shodan.io/search?query=title%3APLC++pstVal-%3Evalue%3Ahtml%2Findex.html; https://www.exploit-db.com/exploits/45187/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.securityfocus.com/bid/106674; https://github.com/secdev/scapy/pull/1409; https://github.com/secdev/scapy/pull/1409/files#diff-441eff981e[PII_REDACTED]11fc6314fe93L1058
CVE: CVE-2019-12193
Published: 2019-07-19
Description: H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://laolisafe.com/h3cloud-sql-injection-vulnerability/; https://laolisafe.com/h3cloud-sql-injection-vulnerability/
CVE: CVE-2018-17792
Published: 2019-07-19
Description: MDaemon Webmail (formerly WorldClient) has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153686/WorldClient-14-Cross-Site-Request-Forgery.html; https://packetstormsecurity.com/files/cve/CVE-2018-17792; https://www.altn.com/Software/MDaemon-Webmail-WorldClient/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://access.redhat.com/errata/RHBA-2019:2824; https://access.redhat.com/errata/RHSA-2019:2571; https://access.redhat.com/errata/RHSA-2019:2582
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-754
References: https://github.com/DaveGamble/cJSON/commit/be749d7efa7c9021da746e685bd6dec79f9dd99b; https://github.com/DaveGamble/cJSON/issues/315; https://www.oracle.com/security-alerts/cpuoct2020.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-19
Description: Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-257, CWE-522
References: http://www.securityfocus.com/bid/109320; https://docs.google.com/document/d/1MBEoJSMvkjp5Kua0bRD_kiDBisL0fOCwTL9uMWj4lGA/edit?usp=sharing; http://www.securityfocus.com/bid/109320
CVE: CVE-2019-11553
Published: 2019-07-19
Description: In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate a user with web restore permission. When requesting the token to do a web restore, an administrator with permission to manage a user could request the token of that user. If the administrator was not authorized to perform web restores but the user was authorized to perform web restores, this would allow the administrator to impersonate the user with greater permissions. In order to exploit this vulnerability, the user would have to be an administrator with access to manage an organization with a user with greater permissions than themselves.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://code42.com/r/support/CVE-2019-11553; https://code42.com/r/support/CVE-2019-11553
CVE: CVE-2019-12453
Published: 2019-07-19
Description: In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.microstrategy.com/producthelp/10.10/Readme/content/web.htm; https://github.com/undefinedmode/CVE-2019-12453; http://www.microstrategy.com/producthelp/10.10/Readme/content/web.htm
CVE: CVE-2019-12945
Published: 2019-07-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-12820
Published: 2019-07-19
Description: A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and personal information it communicates with the server, use unencrypted HTTP. As an example, while logging in through the app to a Jisiwei account, the login request is being sent in cleartext. The vulnerability exists in both the Android and iOS version of the app. An attacker could exploit this by using an MiTM attack on the local network to obtain someone's login credentials, which gives them full access to the robot vacuum cleaner.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-319
References: https://www.kth.se/polopoly_fs/[PII_REDACTED]621210%21/Olsson_Larsson-Forsberg_vacuum.pdf; https://www.kth.se/polopoly_fs/[PII_REDACTED]621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
CVE: CVE-2019-12821
Published: 2019-07-19
Description: A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-330
References: https://www.kth.se/polopoly_fs/[PII_REDACTED]621210%21/Olsson_Larsson-Forsberg_vacuum.pdf; https://www.kth.se/polopoly_fs/[PII_REDACTED]621210%21/Olsson_Larsson-Forsberg_vacuum.pdf
CVE: CVE-2019-13989
Published: 2019-07-19
Description: dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://gitlab.com/aplevich/dpic/issues/4; https://gitlab.com/aplevich/dpic/issues/4