deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10237
Published: 2019-03-27
Description: S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.iwantacve.cn/index.php/archives/172/; http://www.iwantacve.cn/index.php/archives/172/
CVE: CVE-2019-10238
Published: 2019-03-27
Description: Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.iwantacve.cn/index.php/archives/175/; http://www.iwantacve.cn/index.php/archives/175/
CVE: CVE-2019-3829
Published: 2019-03-27
Description: A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416, CWE-415, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html; https://access.redhat.com/errata/RHSA-2019:3600; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-27
Description: An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html; https://seclists.org/bugtraq/2019/Mar/49; https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/
CVE: CVE-2017-7655
Published: 2019-03-27
Description: In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=533775; https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00022.html
CVE: CVE-2017-9626
Published: 2019-03-27
Description: Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This update will restrict remote access by implementing SSH authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-732
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02B; https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02B
CVE: CVE-2018-12178
Published: 2019-03-27
Description: Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html; https://edk2-docs.gitbooks.io/security-advisory/content/dns-pack-size-check.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ABTDKZK2G5XP6JCO3HXMPOA2NRTIYDZ/
CVE: CVE-2018-12179
Published: 2019-03-27
Description: Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
CVSS Score: 7.8 (HIGH)
References: https://edk2-docs.gitbooks.io/security-advisory/content/opal-blocksid-setting-disabled-after-s3.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03912en_us
CVE: CVE-2018-12180
Published: 2019-03-27
Description: Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00046.html; https://access.redhat.com/errata/RHSA-2019:0809; https://access.redhat.com/errata/RHSA-2019:0968
CVE: CVE-2018-12181
Published: 2019-03-27
Description: Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00048.html; https://access.redhat.com/errata/RHSA-2019:2125
CVE: CVE-2018-12182
Published: 2019-03-27
Description: Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-441
References: http://www.securityfocus.com/bid/107648; https://edk2-docs.gitbooks.io/security-advisory/content/sw-smi-confused-deputy-smramsavestate_c.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/
CVE: CVE-2018-12183
Published: 2019-03-27
Description: Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107643; https://edk2-docs.gitbooks.io/security-advisory/content/unlimited-fv-recursion.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP/
CVE: CVE-2018-12545
Published: 2019-03-27
Description: In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096; https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E; https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
CVE: CVE-2018-14814
Published: 2019-03-27
Description: WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01
CVE: CVE-2018-15585
Published: 2019-03-27
Description: Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/blob/b1fc952c7600b825c4b02e2789ddafdea18c8d13/adm/newwinform.php; https://github.com/gnuboard/gnuboard5/blob/b1fc952c7600b825c4b02e2789ddafdea18c8d13/adm/newwinformupdate.php; https://github.com/gnuboard/gnuboard5/commit/b1fc952c7600b825c4b02e2789ddafdea18c8d13
CVE: CVE-2018-3613
Published: 2019-03-27
Description: Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
CVSS Score: 7.8 (HIGH)
References: https://access.redhat.com/errata/RHSA-2019:2125; https://edk2-docs.gitbooks.io/security-advisory/content/authvariable-timestamp-zeroing-on-append_write.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ABTDKZK2G5XP6JCO3HXMPOA2NRTIYDZ/
CVE: CVE-2019-0160
Published: 2019-03-27
Description: Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://tianocore-docs.github.io/SecurityAdvisory/draft/partitiondxe-and-udf-buffer-overflow.html; https://tianocore-docs.github.io/SecurityAdvisory/draft/partitiondxe-and-udf-buffer-overflow.html
CVE: CVE-2019-0161
Published: 2019-03-27
Description: Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00046.html; https://access.redhat.com/errata/RHSA-2019:2125
CVE: CVE-2018-19648
Published: 2019-03-27
Description: An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. NETCONF Access Management (NACM) allows unprivileged users to create privileged users and execute arbitrary commands via the use of the diagnostic-profile over RESTCONF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://supportforums.adtran.com/docs/DOC-9344; https://supportforums.adtran.com/docs/DOC-9344
CVE: CVE-2019-1737
Published: 2019-03-27
Description: A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service (DoS) condition on the affected device. The vulnerability is due to improper socket resources handling in the IP SLA responder application code. An attacker could exploit this vulnerability by sending crafted IP SLA packets to an affected device. An exploit could allow the attacker to cause an interface to become wedged, resulting in an eventual denial of service (DoS) condition on the affected device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-770
References: http://www.securityfocus.com/bid/107604; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-ipsla-dos; http://www.securityfocus.com/bid/107604
CVE: CVE-2019-1738
Published: 2019-03-28
Description: A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit these vulnerabilities by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107597; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nbar; http://www.securityfocus.com/bid/107597
CVE: CVE-2019-1739
Published: 2019-03-28
Description: A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107597; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nbar; http://www.securityfocus.com/bid/107597
CVE: CVE-2019-1740
Published: 2019-03-28
Description: A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability are due to a parsing issue on DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107597; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nbar; http://www.securityfocus.com/bid/107597
CVE: CVE-2019-1741
Published: 2019-03-28
Description: A vulnerability in the Cisco Encrypted Traffic Analytics (ETA) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has been freed. An attacker could exploit this vulnerability by sending crafted, malformed IP packets to an affected device. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-416
References: http://www.securityfocus.com/bid/107614; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-eta-dos; http://www.securityfocus.com/bid/107614
CVE: CVE-2019-1742
Published: 2019-03-28
Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulnerability is due to improper access control to files within the web UI. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to gain access to sensitive configuration information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-16
References: http://www.securityfocus.com/bid/107600; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-xeid; http://www.securityfocus.com/bid/107600
CVE: CVE-2019-1743
Published: 2019-03-28
Description: A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the device. An exploit could allow the attacker to gain elevated privileges on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107591; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-afu; http://www.securityfocus.com/bid/107591
CVE: CVE-2019-1745
Published: 2019-03-28
Description: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected commands. An exploit could allow the attacker to gain root privileges on the affected device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/107588; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-xecmd; http://www.securityfocus.com/bid/107588
CVE: CVE-2019-1746
Published: 2019-03-28
Description: A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation when processing CMP management packets. An attacker could exploit this vulnerability by sending malicious CMP management packets to an affected device. A successful exploit could cause the switch to crash, resulting in a DoS condition. The switch will reload automatically.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107612; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-cmp-dos; http://www.securityfocus.com/bid/107612
CVE: CVE-2019-1747
Published: 2019-03-28
Description: A vulnerability in the implementation of the Short Message Service (SMS) handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper processing of SMS protocol data units (PDUs) that are encoded with a special character set. An attacker could exploit this vulnerability by sending a malicious SMS message to an affected device. A successful exploit could allow the attacker to cause the wireless WAN (WWAN) cellular interface module on an affected device to crash, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/107599; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-sms-dos; http://www.securityfocus.com/bid/107599
CVE: CVE-2019-1748
Published: 2019-03-28
Description: A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability exists because the affected software insufficiently validates certificates. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt and modify confidential information on user connections to the affected software.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/107619; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-pnp-cert; http://www.securityfocus.com/bid/107619
CVE: CVE-2019-1749
Published: 2019-03-28
Description: A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) could allow an unauthenticated, adjacent attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the software insufficiently validates ingress traffic on the ASIC used on the RSP3 platform. An attacker could exploit this vulnerability by sending a malformed OSPF version 2 (OSPFv2) message to an affected device. A successful exploit could allow the attacker to cause a reload of the iosd process, triggering a reload of the affected device and resulting in a DoS condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107615; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-rsp3-ospf; http://www.securityfocus.com/bid/107615
CVE: CVE-2019-1750
Published: 2019-03-28
Description: A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent attacker to cause the switches to reload. The vulnerability is due to incomplete error handling when processing Cisco Discovery Protocol (CDP) packets used with the Easy Virtual Switching System. An attacker could exploit this vulnerability by sending a specially crafted CDP packet. An exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-388
References: http://www.securityfocus.com/bid/107607; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-evss; http://www.securityfocus.com/bid/107607
CVE: CVE-2019-1751
Published: 2019-03-28
Description: A vulnerability in the Network Address Translation 64 (NAT64) functions of Cisco IOS Software could allow an unauthenticated, remote attacker to cause either an interface queue wedge or a device reload. The vulnerability is due to the incorrect handling of certain IPv4 packet streams that are sent through the device. An attacker could exploit this vulnerability by sending specific IPv4 packet streams through the device. An exploit could allow the attacker to either cause an interface queue wedge or a device reload, resulting in a denial of service (DoS) condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107601; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-nat64; http://www.securityfocus.com/bid/107601
CVE: CVE-2019-1752
Published: 2019-03-28
Description: A vulnerability in the ISDN functions of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of specific values in the Q.931 information elements. An attacker could exploit this vulnerability by calling the affected device with specific Q.931 information elements being present. An exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on an affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107589; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-isdn; http://www.securityfocus.com/bid/107589
CVE: CVE-2019-1753
Published: 2019-03-28
Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent (WSMA) functions. An attacker could exploit this vulnerability by submitting a malicious payload to the affected device's web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107602; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-pe; http://www.securityfocus.com/bid/107602
CVE: CVE-2019-1754
Published: 2019-03-28
Description: A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker could exploit this vulnerability by submitting a malicious payload to a specific endpoint in the web UI. A successful exploit could allow the lower-privileged attacker to execute arbitrary commands with higher privileges on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-269
References: http://www.securityfocus.com/bid/107590; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-iosxe-privesc; http://www.securityfocus.com/bid/107590