deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9171
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 1 of 5).
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54635
CVE: CVE-2019-9172
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 2 of 5).
CVSS Score: 5.9 (MEDIUM)
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54795
CVE: CVE-2019-9174
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55468
CVE: CVE-2019-9175
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 3 of 5).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/52524
CVE: CVE-2019-9176
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55664
CVE: CVE-2019-9178
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 4 of 5).
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54803
CVE: CVE-2019-9179
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure (issue 5 of 5).
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54783
CVE: CVE-2019-9217
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Misrepresentation of Critical Information.
CVSS Score: 9.8 (CRITICAL)
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/
CVE: CVE-2019-9219
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 2 of 5).
CVSS Score: 3.7 (LOW)
CWE: CWE-639
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54159
CVE: CVE-2019-9220
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resource Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55653
CVE: CVE-2019-9222
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-732
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56348
CVE: CVE-2019-9223
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/50334
CVE: CVE-2019-9224
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54789
CVE: CVE-2019-9225
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 5 of 5).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54680
CVE: CVE-2019-9756
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54243
CVE: CVE-2019-9890
Published: 2019-04-17
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions.
CVSS Score: 9.1 (CRITICAL)
References: https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/
CVE: CVE-2018-18094
Published: 2019-04-17
Description: Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/107886; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00201.html; http://www.securityfocus.com/bid/107886
CVE: CVE-2019-0158
Published: 2019-04-17
Description: Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/107888; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00236.html; http://www.securityfocus.com/bid/107888
CVE: CVE-2019-0162
Published: 2019-04-17
Description: Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.8 (LOW)
References: https://support.f5.com/csp/article/K26710120; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00238.html; https://support.f5.com/csp/article/K26710120
CVE: CVE-2019-0163
Published: 2019-04-17
Description: Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00239.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00239.html
CVE: CVE-2018-20028
Published: 2019-04-17
Description: Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
CVSS Score: 6.5 (MEDIUM)
References: https://contao.org/en/news.html; https://contao.org/en/news/security-vulnerability-cve-2018-20028.html; https://contao.org/en/news.html
CVE: CVE-2019-10641
Published: 2019-04-17
Description: Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://contao.org/en/news.html; https://contao.org/en/news/security-vulnerability-cve-2019-10641.html; https://contao.org/en/news.html
CVE: CVE-2019-10643
Published: 2019-04-17
Description: Contao 4.7 allows Use of a Key Past its Expiration Date.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://contao.org/en/news.html; https://contao.org/en/news/security-vulnerability-cve-2019-10643.html; https://contao.org/en/news.html
CVE: CVE-2018-0248
Published: 2019-04-17
Description: A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an aUTHENTICated, remote attacker to cause the device to reload unexpectedly during device configuration when the administrator is using this GUI, causing a denial of service (DoS) condition on an affected device. The attacker would need to have valid administrator credentials on the device. This vulnerability is due to incomplete input validation for unexpected configuration options that the attacker could submit while accessing the GUI configuration menus. An attacker could exploit these vulnerabilities by authenticating to the device and submitting crafted user input when using the administrative GUI configuration feature. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Software versions prior to 8.3.150.0, 8.5.140.0, 8.8.111.0 are affected by this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108009; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-gui; http://www.securityfocus.com/bid/108009
CVE: CVE-2018-0382
Published: 2019-04-17
Description: A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. Versions 8.1 and 8.5 are affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/108005; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlan-hijack; http://www.securityfocus.com/bid/108005
CVE: CVE-2019-1654
Published: 2019-04-17
Description: A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authentication, which allows for root access to the underlying Linux OS. The attacker would need valid device credentials. The vulnerability exists because the software improperly validates user-supplied input at the CLI authentication prompt for development shell access. An attacker could exploit this vulnerability by authenticating to the device and entering crafted input at the CLI. A successful exploit could allow the attacker to access the AP development shell without proper authentication, which allows for root access to the underlying Linux OS. Software versions prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 are affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255, CWE-306
References: http://www.securityfocus.com/bid/107991; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-aironet-shell; http://www.securityfocus.com/bid/107991
CVE: CVE-2019-1686
Published: 2019-04-17
Description: A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect processing of the ACL applied to an interface of an affected device when Cisco Express Forwarding load balancing using the 3-tuple hash algorithm is enabled. An attacker could exploit this vulnerability by sending traffic through an affected device that should otherwise be denied by the configured ACL. An exploit could allow the attacker to bypass protection offered by a configured ACL on the affected device. There are workarounds that address this vulnerability. Affected Cisco IOS XR versions are: Cisco IOS XR Software Release 5.1.1 and later till first fixed. First Fixed Releases: 6.5.2 and later, 6.6.1 and later.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/108026; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-iosxracl; http://www.securityfocus.com/bid/108026
CVE: CVE-2019-1710
Published: 2019-04-17
Description: A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to access internal applications running on the sysadmin VM. The vulnerability is due to incorrect isolation of the secondary management interface from internal sysadmin applications. An attacker could exploit this vulnerability by connecting to one of the listening internal applications. A successful exploit could result in unstable conditions, including both a denial of service and remote unauthenticated access to the device. This vulnerability has been fixed in Cisco IOS XR 64-bit Software Release 6.5.3 and 7.0.1, which will edit the calvados_boostrap.cfg file and reload the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108007; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr; http://www.securityfocus.com/bid/108007
CVE: CVE-2019-1711
Published: 2019-04-17
Description: A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by repeatedly sending unauthenticated gRPC requests to the affected device. A successful exploit could cause the emsd process to crash, resulting in a DoS condition. Resolved in Cisco IOS XR 6.5.1 and later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108017; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ios-xr-dos; http://www.securityfocus.com/bid/108017
CVE: CVE-2019-1712
Published: 2019-04-17
Description: A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the PIM process to restart, resulting in a denial of service condition on an affected device. The vulnerability is due to the incorrect processing of crafted AutoRP packets. An attacker could exploit this vulnerability by sending crafted packets to port UDP 496 on a reachable IP address on the device. A successful exploit could allow the attacker to cause the PIM process to restart. Software versions prior to 6.2.3, 6.3.2, 6.4.0, and 6.5.1 are affected.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108025; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-iosxr-pim-dos; http://www.securityfocus.com/bid/108025
CVE: CVE-2019-1718
Published: 2019-04-17
Description: A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of Secure Sockets Layer (SSL) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. An successful exploit could increase the resource usage on the system, eventually leading to a DoS condition. This vulnerability affects version 2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/108030; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ise-ssl-dos; http://www.securityfocus.com/bid/108030
CVE: CVE-2019-1719
Published: 2019-04-18
Description: A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco ISE software version 2.1 is affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107993; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ise-xss; http://www.securityfocus.com/bid/107993
CVE: CVE-2019-1720
Published: 2019-04-18
Description: A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a specifically crafted XML payload. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition until the system is manually rebooted. Software versions prior to X12.5.1 are affected.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108002; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ces-tvcs-dos; http://www.securityfocus.com/bid/108002
CVE: CVE-2019-1721
Published: 2019-04-18
Description: A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108016; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-es-tvcs-dos; http://www.securityfocus.com/bid/108016
CVE: CVE-2019-1722
Published: 2019-04-18
Description: A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. The arbitrary actions include adding an attacker-controlled device and redirecting calls intended for a specific user. For more information about CSRF attacks and potential mitigations, see Understanding Cross-Site Request Forgery Threat Vectors. This vulnerability is fixed in software version X12.5.1 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/108006; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ex-vcs-xsrf; http://www.securityfocus.com/bid/108006
CVE: CVE-2019-1725
Published: 2019-04-18
Description: A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local attacker to overwrite an arbitrary file on disk. It is also possible the attacker could inject CLI command parameters that should not be allowed for a specific subset of local management CLI commands. The vulnerability is due to lack of proper input validation of user input for local management CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted form of a limited subset of local management CLI commands. An exploit could allow the attacker to overwrite an arbitrary files on disk or inject CLI command parameters that should have been disabled. This vulnerability is fixed in software version 4.0(2a) and later.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108082; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-ucs-cli-inj; http://www.securityfocus.com/bid/108082