deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-9516
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9517
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9518
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9519
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9520
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9521
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9522
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9523
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9524
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2019-16977
Published: 2019-10-23
Description: In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fusionpbx/fusionpbx/commit/fc8e4e2d278ce6bffff21b04248d469a59eb8cd4; https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-10/; https://github.com/fusionpbx/fusionpbx/commit/fc8e4e2d278ce6bffff21b04248d469a59eb8cd4
CVE: CVE-2019-17093
Published: 2019-10-23
Description: An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://safebreach.com/Post/Avast-Antivirus-AVG-Antivirus-DLL-Preloading-into-PPL-and-Potential-Abuses; https://safebreach.com/blog; https://safebreach.com/Post/Avast-Antivirus-AVG-Antivirus-DLL-Preloading-into-PPL-and-Potential-Abuses
CVE: CVE-2019-17606
Published: 2019-10-23
Description: The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jaredly/hexo-admin/commits/master; https://mega.nz/#%218MYnUQzC%21ZCqixrGyHdBhimCmrszSXdFmI2feImhuZZMcnplNBQQ; https://www.npmjs.com/advisories
CVE: CVE-2019-18348
Published: 2019-10-23
Description: An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html; https://bugs.python.org/issue30458#msg347282; https://bugzilla.redhat.com/show_bug.cgi?id=1727276
CVE: CVE-2002-2439
Published: 2019-10-23
Description: Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/security/cve/cve-2002-2439; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2002-2439; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19351
CVE: CVE-2014-2304
Published: 2019-10-23
Description: A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service. This effect is the result of a flaw in OpenFlow protocol processing, where specific malformed and mistimed FEATURES_REPLY messages cause the controller service to not delete switch and port data from its internal tracking structures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://dovernetworks.com/wp-content/uploads/2014/03/OpenFloodlight-03052014.pdf; http://dovernetworks.com/wp-content/uploads/2014/03/OpenFloodlight-03052014.pdf
CVE: CVE-2019-18350
Published: 2019-10-23
Description: In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of JavaScript code in the login after-action script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ant-design/ant-design-pro/pull/5461; https://github.com/ant-design/ant-design-pro/pull/5461
CVE: CVE-2019-18355
Published: 2019-10-23
Description: An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes; https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes
CVE: CVE-2019-18356
Published: 2019-10-23
Description: An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes; https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes
CVE: CVE-2019-18357
Published: 2019-10-23
Description: An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes; https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes
CVE: CVE-2019-3982
Published: 2019-10-23
Description: Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of specific imported scan types. An authenticated, remote attacker could potentially exploit this vulnerability to cause a Nessus scanner to become temporarily unresponsive.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.tenable.com/security/tns-2019-06; https://www.tenable.com/security/tns-2019-06
CVE: CVE-2019-6144
Published: 2019-10-23
Description: This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://help.forcepoint.com/security/CVE/CVE-2019-6144.html; https://help.forcepoint.com/security/CVE/CVE-2019-6144.html
CVE: CVE-2019-9596
Published: 2019-10-23
Description: Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/152986/Darktrace-Enterpise-Immune-System-3.0.9-3.0.10-Cross-Site-Request-Forgery.html; https://github.com/gerwout/CVE-2019-9596-and-CVE-2019-9597/blob/master/poc.html; https://seclists.org/bugtraq/2019/May/54
CVE: CVE-2019-9597
Published: 2019-10-23
Description: Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/152986/Darktrace-Enterpise-Immune-System-3.0.9-3.0.10-Cross-Site-Request-Forgery.html; https://github.com/gerwout/CVE-2019-9596-and-CVE-2019-9597/blob/master/poc.html; https://seclists.org/bugtraq/2019/May/54
CVE: CVE-2019-12415
Published: 2019-10-23
Description: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E; https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced[PII_REDACTED]b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E
CVE: CVE-2019-18359
Published: 2019-10-23
Description: A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads to remote denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00030.html; https://sourceforge.net/p/mp3gain/bugs/46/
CVE: CVE-2019-18370
Published: 2019-10-23
Description: An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar zxf command to decompress, so one can control the contents of the files in the decompressed directory. In addition, the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml, and there is a command injection vulnerability, as demonstrated by api/xqnetdetect/netspeed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/remote_command_execution_vulnerability.py; https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/remote_command_execution_vulnerability.py
CVE: CVE-2019-18371
Published: 2019-10-23
Description: An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can bypass authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py; https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/arbitrary_file_read_vulnerability.py
CVE: CVE-2019-18382
Published: 2019-10-23
Description: An issue was discovered on AVStar PE204 3.10.70 IP camera devices. A denial of service can occur on open TCP port 23456. After a TELNET connection, no TCP ports are open.
CVSS Score: 7.5 (HIGH)
References: https://github.com/gusrmsdlrh/CVE-PE204; https://github.com/gusrmsdlrh/CVE-PE204
CVE: CVE-2019-18383
Published: 2019-10-23
Description: An issue was discovered on TerraMaster FS-210 4.0.19 devices. One can download backup files remotely from terramaster_TNAS-00E43A_config_backup.bin without permission.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/gusrmsdlrh/CVE-Reserved/blob/master/README.md; https://github.com/gusrmsdlrh/CVE-Reserved/blob/master/README.md
CVE: CVE-2019-18384
Published: 2019-10-23
Description: An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=*public*%25252Fadmin_OnlyRead.txt substring.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/gusrmsdlrh/CVE-Reserved2/blob/master/README.md; https://github.com/gusrmsdlrh/CVE-Reserved2/blob/master/README.md
CVE: CVE-2019-18385
Published: 2019-10-23
Description: An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/gusrmsdlrh/CVE-Reserved3/blob/master/README.md; https://github.com/gusrmsdlrh/CVE-Reserved3/blob/master/README.md
CVE: CVE-2019-8236
Published: 2019-10-23
Description: Creative Cloud Desktop Application version 4.6.1 and earlier versions have Security Bypass vulnerability. Successful exploitation could lead to Privilege Escalation in the context of the current user.
CVSS Score: 9.8 (CRITICAL)
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html
CVE: CVE-2019-8237
Published: 2019-10-23
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have an insufficiently robust encryption vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-8238
Published: 2019-10-23
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier; 2[PII_REDACTED]9 and earlier versions; 2[PII_REDACTED]0 and earlier version; 2[PII_REDACTED]8 and earlier version; 2[PII_REDACTED]5 and earlier versions; 2[PII_REDACTED]3 and earlier versions have a Path Traversal vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html
CVE: CVE-2019-18212
Published: 2019-10-23
Description: XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/angelozerr/lsp4xml/; https://github.com/angelozerr/lsp4xml/blob/master/CHANGELOG.md#others; https://github.com/angelozerr/lsp4xml/pull/567
CVE: CVE-2019-18213
Published: 2019-10-23
Description: XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response capture for password cracking). This occurs in extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://github.com/angelozerr/lsp4xml/; https://github.com/angelozerr/lsp4xml/blob/master/CHANGELOG.md#others; https://github.com/angelozerr/lsp4xml/pull/566
CVE: CVE-2019-18387
Published: 2019-10-23
Description: Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.sevenlayers.com/index.php/266-hotel-and-lodge-management-system-1-0-sqli; https://www.sevenlayers.com/index.php/266-hotel-and-lodge-management-system-1-0-sqli
CVE: CVE-2019-18393
Published: 2019-10-24
Description: PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/igniterealtime/Openfire/pull/1498; https://swarm.ptsecurity.com/openfire-admin-console/; https://github.com/igniterealtime/Openfire/pull/1498
CVE: CVE-2019-18394
Published: 2019-10-24
Description: A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/igniterealtime/Openfire/pull/1497; https://swarm.ptsecurity.com/openfire-admin-console/; https://github.com/igniterealtime/Openfire/pull/1497
CVE: CVE-2019-4397
Published: 2019-10-24
Description: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162239
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162239; https://www.ibm.com/support/pages/node/1077147; https://exchange.xforce.ibmcloud.com/vulnerabilities/162239
CVE: CVE-2019-4398
Published: 2019-10-24
Description: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.
CVSS Score: 3.3 (LOW)
CWE: CWE-552
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162259; https://www.ibm.com/support/pages/node/1077123; https://exchange.xforce.ibmcloud.com/vulnerabilities/162259
CVE: CVE-2019-4459
Published: 2019-10-24
Description: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163656; https://www.ibm.com/support/pages/node/1096342; https://exchange.xforce.ibmcloud.com/vulnerabilities/163656
CVE: CVE-2019-4486
Published: 2019-10-24
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164070; https://www.ibm.com/support/pages/node/1075023; https://exchange.xforce.ibmcloud.com/vulnerabilities/164070
CVE: CVE-2019-15703
Published: 2019-10-24
Description: An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://fortiguard.com/psirt/FG-IR-19-186; https://fortiguard.com/psirt/FG-IR-19-186
CVE: CVE-2019-17581
Published: 2019-10-24
Description: tonyy dormsystem through 1.3 allows DOM XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Tooonyy/dormsystem/issues/1; https://github.com/Tooonyy/dormsystem/issues/2; https://github.com/Tooonyy/dormsystem/issues/1