deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-1394
Published: 2020-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/archive/1/534568/100/0/threaded; https://plugins.trac.wordpress.org/changeset/1073334/; https://plugins.trac.wordpress.org/changeset/1076678/photo-gallery
CVE: CVE-2012-4029
Published: 2020-02-08
Description: Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://support.chamilo.org/attachments/download/2863/chamilo-1.8.8.4-to-1.8.8.6.patch; https://packetstormsecurity.com/files/115927/Chamilo-1.8.8.4-XSS-File-Deletion.html; https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-7-2012-07-16-Moderate-risk-Several-moderate-security-flaws
CVE: CVE-2012-4381
Published: 2020-02-08
Description: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: http://osvdb.org/show/osvdb/85106; http://www.openwall.com/lists/oss-security/2012/08/31/10; http://www.openwall.com/lists/oss-security/2012/08/31/6
CVE: CVE-2014-8739
Published: 2020-02-08
Description: Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://osvdb.org/show/osvdb/113669; http://osvdb.org/show/osvdb/113673; http://www.openwall.com/lists/oss-security/2014/11/11/4
CVE: CVE-2015-2062
Published: 2020-02-08
Description: Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/130796/WordPress-Huge-IT-Slider-2.6.8-SQL-Injection.html; http://www.securityfocus.com/archive/1/archive/1/534852/100/0/threaded; https://wordpress.org/support/topic/huge-it-slider-security-vulnerability-notification-sql-injection
CVE: CVE-2015-2207
Published: 2020-02-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/132807/NetCracker-Resource-Management-System-8.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/archive/1/536053/100/0/threaded; http://packetstormsecurity.com/files/132807/NetCracker-Resource-Management-System-8.0-Cross-Site-Scripting.html
CVE: CVE-2015-3423
Published: 2020-02-08
Description: Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) ctrl, (2) h____%2427, (3) h____%2439, (4) param0, (5) param1, (6) param2, (7) param3, (8) param4, (9) filter_INSERT_COUNT, (10) filter_MINOR_FALLOUT, (11) filter_UPDATE_COUNT, (12) sort, or (13) sessid parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/132808/NetCracker-Resource-Management-System-8.0-SQL-Injection.html; http://www.securityfocus.com/archive/1/archive/1/536054/100/0/threaded; http://packetstormsecurity.com/files/132808/NetCracker-Resource-Management-System-8.0-SQL-Injection.html
CVE: CVE-2012-4512
Published: 2020-02-08
Description: The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face source, related to "type confusion."
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0005.html; http://em386.blogspot.com/2010/12/webkit-css-type-confusion.html; http://quickgit.kde.org/index.php?p=kdelibs.git&a=commitdiff&h=a872c8a969a8bd3706253d6ba24088e4f07f3352
CVE: CVE-2012-5570
Published: 2020-02-08
Description: The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/11/20/4; http://www.openwall.com/lists/oss-security/2012/11/27/2; https://drupal.org/node/1808616
CVE: CVE-2015-5741
Published: 2020-02-08
Description: The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html; http://seclists.org/oss-sec/2015/q3/237
CVE: CVE-2017-18641
Published: 2020-02-10
Description: In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447; https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1661447
CVE: CVE-2020-8822
Published: 2020-02-10
Description: Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sku11army.blogspot.com/2020/02/digi-transport-stored-xss-on-wr-family.html; https://sku11army.blogspot.com/2020/02/digi-transport-stored-xss-on-wr-family.html
CVE: CVE-2020-8823
Published: 2020-02-10
Description: htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/theyiyibest/Reflected-XSS-on-SockJS; https://github.com/theyiyibest/Reflected-XSS-on-SockJS/issues/1; https://snyk.io/vuln/SNYK-JS-SOCKJS-548397
CVE: CVE-2020-7059
Published: 2020-02-10
Description: When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html; https://bugs.php.net/bug.php?id=79099; https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
CVE: CVE-2020-7060
Published: 2020-02-10
Description: When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html; https://bugs.php.net/bug.php?id=79037; https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html
CVE: CVE-2020-8825
Published: 2020-02-10
Description: index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156281/Vanilla-Forum-2.6.3-Cross-Site-Scripting.html; https://github.com/hacky1997/CVE-2020-8825; http://packetstormsecurity.com/files/156281/Vanilla-Forum-2.6.3-Cross-Site-Scripting.html
CVE: CVE-2019-20059
Published: 2020-02-10
Description: payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection. NOTE: this issue exists because of an incomplete fix for CVE-2019-19732.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-352
References: https://github.com/jra89/CVE-2019-20059; https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad; https://mfscripts.com/
CVE: CVE-2019-20060
Published: 2020-02-10
Description: MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad; https://mfscripts.com/; https://yetishare.com/
CVE: CVE-2019-20061
Published: 2020-02-10
Description: The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad; https://mfscripts.com/; https://yetishare.com/
CVE: CVE-2019-20062
Published: 2020-02-10
Description: MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad; https://mfscripts.com/; https://yetishare.com/
CVE: CVE-2012-6666
Published: 2020-02-10
Description: vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/37944; https://www.securityfocus.com/bid/55908; https://www.exploit-db.com/exploits/37944
CVE: CVE-2013-1353
Published: 2020-02-10
Description: Orange HRM 2.7.1 allows XSS via the vacancy name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/119461/OrangeHRM-2.7.1-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/119461/OrangeHRM-2.7.1-Cross-Site-Scripting.html
CVE: CVE-2012-6449
Published: 2020-02-10
Description: The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/119113/C-Panel-WHM-11.34.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/119113/C-Panel-WHM-11.34.0-Cross-Site-Scripting.html
CVE: CVE-2012-6611
Published: 2020-02-10
Description: An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.14.g3. It has a blank administrative password by default, and can be successfully used without setting this password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://web.archive.org/web/[PII_REDACTED]3016/http://blog.tempest.com.br/joao-paulo-campello/path-traversal-on-polycom-web-management-interface.html; https://www.exploit-db.com/exploits/43032; https://web.archive.org/web/[PII_REDACTED]3016/http://blog.tempest.com.br/joao-paulo-campello/path-traversal-on-polycom-web-management-interface.html
CVE: CVE-2014-5083
Published: 2020-02-10
Description: A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5083 pertains to instances of fwrite in Sphider.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html; http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
CVE: CVE-2014-5084
Published: 2020-02-10
Description: A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execute arbitrary code. CVE-2014-5084 pertains to instances of fwrite in Sphider Pro only, but do not exist in either Sphider or Sphider Plus.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html; http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
CVE: CVE-2014-5085
Published: 2020-02-10
Description: A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5085 pertains to instances of fwrite in Sphider Plus, but do not exist in either Sphider or Sphider Pro.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html; http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
CVE: CVE-2014-5086
Published: 2020-02-10
Description: A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fwrite in Sphider Pro and Sphider Plus only, but don’t exist in Sphider.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html; http://packetstormsecurity.com/files/127720/Sphider-Search-Engine-Command-Execution-SQL-Injection.html
CVE: CVE-2019-20451
Published: 2020-02-10
Description: The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/papers/47535; https://www.exploit-db.com/papers/47535
CVE: CVE-2020-1697
Published: 2020-02-10
Description: It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697
CVE: CVE-2012-1994
Published: 2020-02-10
Description: HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/53315; http://www.securitytracker.com/id?1026987; https://exchange.xforce.ibmcloud.com/vulnerabilities/75294
CVE: CVE-2012-2204
Published: 2020-02-10
Description: InfoSphere Guardium aix_ktap module: DoS
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/76968; https://exchange.xforce.ibmcloud.com/vulnerabilities/76968
CVE: CVE-2012-5828
Published: 2020-02-10
Description: BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/56793; https://exchange.xforce.ibmcloud.com/vulnerabilities/80555; https://packetstormsecurity.com/files/cve/CVE-2012-5828
CVE: CVE-2019-19659
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a user account by changing the password, update users' details, and escalate privileges via RAPR/DefineUsersSet.html.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19659.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19660
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate the SMTP setting and other network settings via RAPR/NetworkSettingsSet.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://raw.githubusercontent.com/harshit-shukla/CVE/master/CVE-2019-19660.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19663
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after exploiting it at RAPR/FolderSetsSet.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19663.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19665
Published: 2020-02-10
Description: A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server FTP settings at RAPR/FTPSettingsSet.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19665.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2020-8089
Published: 2020-02-10
Description: Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Piwigo/Piwigo/issues/1150; https://piwigo.org/forum/viewforum.php?id=23; https://github.com/Piwigo/Piwigo/issues/1150
CVE: CVE-2013-2108
Published: 2020-02-10
Description: WordPress WP Cleanfix Plugin 2.4.4 has CSRF
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2013/05/18/11; http://www.securityfocus.com/bid/59940; https://exchange.xforce.ibmcloud.com/vulnerabilities/84435
CVE: CVE-2013-2109
Published: 2020-02-10
Description: WordPress plugin wp-cleanfix has Remote Code Execution
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2013/05/18/11; https://exchange.xforce.ibmcloud.com/vulnerabilities/84434; http://www.openwall.com/lists/oss-security/2013/05/18/11
CVE: CVE-2019-19662
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19662.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19664
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19664.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19661
Published: 2020-02-10
Description: A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19661%20%28Un-authenticated%29.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19666
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/EventNoticesSet.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19666.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19667
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP address via RAPR/BlockedClients.html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19667.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19669
Published: 2020-02-10
Description: A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19669.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19670
Published: 2020-02-10
Description: A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in stored XSS, website defacement, etc. via ExtraHTTPHeader to RAPR/WebSettingsGeneralSet.html.
CVSS Score: 6.1 (MEDIUM)
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19670.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2019-19668
Published: 2020-02-10
Description: A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that are used on the server via RAPR/TriggerServerFunction.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/harshit-shukla/CVE; https://github.com/harshit-shukla/CVE/blob/master/CVE-2019-19668.md; https://github.com/harshit-shukla/CVE
CVE: CVE-2011-1596
Published: 2020-02-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-18642
Published: 2020-02-10
Description: Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://iayanpahwa.github.io/Reverse-Engineering-IoT-Devices/; https://iayanpahwa.github.io/Reverse-Engineering-IoT-Devices/