deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11325
Published: 2019-11-21
Description: An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-116
References: https://github.com/symfony/symfony/releases/tag/v4.3.8; https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3; https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
CVE: CVE-2019-18887
Published: 2019-11-21
Description: An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVSS Score: 8.1 (HIGH)
CWE: CWE-203
References: https://github.com/symfony/symfony/releases/tag/v4.3.8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
CVE: CVE-2019-18888
Published: 2019-11-21
Description: An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: https://github.com/symfony/symfony/releases/tag/v4.3.8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
CVE: CVE-2019-18889
Published: 2019-11-21
Description: An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/symfony/symfony/releases/tag/v4.3.8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/; https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
CVE: CVE-2019-18933
Published: 2019-11-21
Description: In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/; https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6; https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/
CVE: CVE-2019-19221
Published: 2019-11-21
Description: In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libarchive/libarchive/commit/22b1db9d46654afc6f0c28f90af8cdc84a199f41; https://github.com/libarchive/libarchive/issues/1276; https://lists.debian.org/debian-lts-announce/2022/04/msg00020.html
CVE: CVE-2012-2079
Published: 2019-11-22
Description: A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2012/04/07/1; https://www.drupal.org/node/1506562; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2019-13157
Published: 2019-11-22
Description: nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://cve.naver.com/detail/cve-2019-13157; https://cve.naver.com/detail/cve-2019-13157
CVE: CVE-2018-10854
Published: 2019-11-22
Description: cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854
CVE: CVE-2019-10203
Published: 2019-11-22
Description: PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-681, CWE-681
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10203; https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-06.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10203
CVE: CVE-2019-10206
Published: 2019-11-22
Description: ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206
CVE: CVE-2019-19227
Published: 2019-11-22
Description: In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1
CVE: CVE-2012-3407
Published: 2019-11-22
Description: plow has local buffer overflow vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2012/07/11/16; https://access.redhat.com/security/cve/cve-2012-3407; https://security-tracker.debian.org/tracker/CVE-2012-3407
CVE: CVE-2014-3585
Published: 2019-11-22
Description: redhat-upgrade-tool: Does not check GPG signatures when upgrading versions
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://access.redhat.com/security/cve/cve-2014-3585; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3585; https://access.redhat.com/security/cve/cve-2014-3585
CVE: CVE-2015-1780
Published: 2019-11-22
Description: oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://access.redhat.com/security/cve/cve-2015-1780; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1780; https://access.redhat.com/security/cve/cve-2015-1780
CVE: CVE-2015-5694
Published: 2019-11-22
Description: Designate does not enforce the DNS protocol limit concerning record set sizes
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2015/07/28/11; http://www.openwall.com/lists/oss-security/2015/07/29/6; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5694
CVE: CVE-2015-7810
Published: 2019-11-22
Description: libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367
References: http://www.openwall.com/lists/oss-security/2015/10/12/7; http://www.securityfocus.com/bid/72769; https://access.redhat.com/security/cve/cve-2015-7810
CVE: CVE-2019-19013
Published: 2019-11-22
Description: A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/155426/Pagekit-CMS-1.0.17-Cross-Site-Request-Forgery.html; https://packetstormsecurity.com/files/155426/Pagekit-CMS-1.0.17-Cross-Site-Request-Forgery.html
CVE: CVE-2019-3427
Published: 2019-11-22
Description: The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users’ information leakage.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011863; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011863
CVE: CVE-2019-3428
Published: 2019-11-22
Description: The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users’ information leakage.
CVSS Score: 6.5 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011863; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011863
CVE: CVE-2019-4214
Published: 2019-11-22
Description: IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
CVSS Score: 3.7 (LOW)
CWE: CWE-311, CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159185; https://www.ibm.com/support/pages/node/1110171; https://exchange.xforce.ibmcloud.com/vulnerabilities/159185
CVE: CVE-2019-4215
Published: 2019-11-22
Description: IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 159186.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159186; https://www.ibm.com/support/pages/node/1109769; https://exchange.xforce.ibmcloud.com/vulnerabilities/159186
CVE: CVE-2019-4216
Published: 2019-11-22
Description: IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159187; https://www.ibm.com/support/pages/node/1109745; https://exchange.xforce.ibmcloud.com/vulnerabilities/159187
CVE: CVE-2019-4243
Published: 2019-11-22
Description: IBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like accessing solrconfig.xml and could allow an attacker to perform disruptive administrator tasks. IBM X-Force ID: 159517.
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159517; https://www.ibm.com/support/pages/node/1109721; https://exchange.xforce.ibmcloud.com/vulnerabilities/159517
CVE: CVE-2019-4569
Published: 2019-11-22
Description: IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166719.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166719; https://www.ibm.com/support/pages/node/1110135; https://exchange.xforce.ibmcloud.com/vulnerabilities/166719
CVE: CVE-2019-4570
Published: 2019-11-22
Description: IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 166720.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166720; https://www.ibm.com/support/pages/node/1110141; https://exchange.xforce.ibmcloud.com/vulnerabilities/166720
CVE: CVE-2012-0812
Published: 2019-11-22
Description: PostfixAdmin 2.3.4 has multiple XSS vulnerabilities
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://security.gentoo.org/glsa/glsa-201209-18.xml; http://www.openwall.com/lists/oss-security/2012/01/26/12; http://www.openwall.com/lists/oss-security/2012/01/27/5
CVE: CVE-2012-0877
Published: 2019-11-22
Description: PyXML: Hash table collisions CPU usage Denial of Service
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://seclists.org/oss-sec/2014/q3/96; http://www.openwall.com/lists/oss-security/2014/07/08/11; https://access.redhat.com/security/cve/cve-2012-0877
CVE: CVE-2019-18790
Published: 2019-11-22
Description: An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://downloads.asterisk.org/pub/security/AST-2019-006.html; https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
CVE: CVE-2019-18976
Published: 2019-11-22
Description: An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://downloads.asterisk.org/pub/security/AST-2019-008.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html; https://packetstormsecurity.com/files/155436/Asterisk-Project-Security-Advisory-AST-2019-008.html
CVE: CVE-2013-6811
Published: 2019-11-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding, (2) Port Triggering Entries, (3) URL Filters in Parental Control, (4) Print Server settings, (5) QoS Queue Setup, or (6) QoS Classification Entries.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89612; https://web.archive.org/web/[PII_REDACTED]1355/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10005; https://exchange.xforce.ibmcloud.com/vulnerabilities/89612
CVE: CVE-2013-6880
Published: 2019-11-22
Description: Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-12/0051.html; http://www.7elements.co.uk/news/cve-2013-6880; http://www.7elements.co.uk/resources/blog/cve-2013-6880-proof-concept
CVE: CVE-2019-15652
Published: 2019-11-22
Description: The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-15652-satlink-vsat-vulnerabilities/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=26455; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2019-15652-satlink-vsat-vulnerabilities/
CVE: CVE-2019-17445
Published: 2019-11-22
Description: An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be forced to copy files from the filesystem to other locations via Symbolic Link Following.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://eracent.com/security-bulletin-cve-2019-17445/; https://eracent.com/security-bulletin-cve-2019-17445/
CVE: CVE-2019-17446
Published: 2019-11-22
Description: An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://eracent.com/security-bulletin-cve-2019-17446/; https://eracent.com/security-bulletin-cve-2019-17446/
CVE: CVE-2019-18610
Published: 2019-11-22
Description: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://downloads.asterisk.org/pub/security/AST-2019-007.html; https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
CVE: CVE-2019-9536
Published: 2019-11-22
Description: Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-755
References: https://github.com/axi0mX/alloc8; https://github.com/axi0mX/ipwndfu/blob/master/alloc8.py; https://github.com/axi0mX/alloc8
CVE: CVE-2012-6077
Published: 2019-11-22
Description: W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/12/30/3; https://security-tracker.debian.org/tracker/CVE-2012-6077; https://www.acunetix.com/vulnerabilities/web/wordpress-w3-total-cache-plugin-predictable-cache-filenames/
CVE: CVE-2012-6078
Published: 2019-11-22
Description: W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/12/30/3; https://security-tracker.debian.org/tracker/CVE-2012-6078; https://www.acunetix.com/vulnerabilities/web/wordpress-w3-total-cache-plugin-predictable-cache-filenames/
CVE: CVE-2012-6079
Published: 2019-11-22
Description: W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/12/30/3; https://security-tracker.debian.org/tracker/CVE-2012-6079; https://www.acunetix.com/vulnerabilities/web/wordpress-w3-total-cache-plugin-predictable-cache-filenames/
CVE: CVE-2013-0203
Published: 2019-11-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/calendar/ajax/event/new.php or (2) url parameter to apps/bookmarks/ajax/addBookmark.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/81478; https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/; https://exchange.xforce.ibmcloud.com/vulnerabilities/81478
CVE: CVE-2013-6234
Published: 2019-11-22
Description: Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload."
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/125497; http://www.exploit-db.com/exploits/32040; https://exchange.xforce.ibmcloud.com/vulnerabilities/91504
CVE: CVE-2013-6239
Published: 2019-11-22
Description: Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter in a detail action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/123764; http://seclists.org/fulldisclosure/2013/Oct/221; https://exchange.xforce.ibmcloud.com/vulnerabilities/88276
CVE: CVE-2013-6878
Published: 2019-11-22
Description: Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB23186; https://www.htbridge.com/advisory/HTB23186
CVE: CVE-2013-6879
Published: 2019-11-22
Description: The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.htbridge.com/advisory/HTB23186; https://www.htbridge.com/advisory/HTB23186
CVE: CVE-2014-1238
Published: 2019-11-22
Description: Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/bugtraq/2014/Jan/41; https://seclists.org/bugtraq/2014/Jan/41
CVE: CVE-2014-2213
Published: 2019-11-22
Description: Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://seclists.org/oss-sec/2014/q1/444; http://www.securityfocus.com/bid/65843; https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/
CVE: CVE-2014-2214
Published: 2019-11-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q1/444; https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/; http://seclists.org/oss-sec/2014/q1/444