deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16893
Published: 2020-02-03
Description: The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://exploit-db.com/exploits/47958; https://exploit-db.com/exploits/47958
CVE: CVE-2019-4732
Published: 2020-02-03
Description: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-426
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172618; https://www.ibm.com/support/pages/node/1288060; https://exchange.xforce.ibmcloud.com/vulnerabilities/172618
CVE: CVE-2020-4224
Published: 2020-02-03
Description: IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encrypted when it contained symbolic links. IBM X-Force ID: 175133.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175133; https://www.ibm.com/support/pages/node/1288150; https://exchange.xforce.ibmcloud.com/vulnerabilities/175133
CVE: CVE-2020-5182
Published: 2020-02-03
Description: The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered by any user. If it doesn't contain rel="noopener" (or similar attributes such as noreferrer), the tabnabbing may occur. To reproduce the bug, create a business with a website link that contains JavaScript to exploit the window.opener property (for example, by setting window.opener.location).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://www.cmsjunkie.com/blog/joomla_business_directory_5-2-9_release/; https://www.cmsjunkie.com/blog/joomla_business_directory_5-2-9_release/
CVE: CVE-2020-8548
Published: 2020-02-03
Description: massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/antonreshetov/massCode/issues/43; https://github.com/antonreshetov/massCode/issues/44; https://github.com/antonreshetov/massCode/issues/43
CVE: CVE-2020-8549
Published: 2020-02-03
Description: Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.html; https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt; https://wpvulndb.com/vulnerabilities/10056
CVE: CVE-2013-2673
Published: 2020-02-03
Description: Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html; https://www.securityfocus.com/bid/59727; http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html
CVE: CVE-2013-2674
Published: 2020-02-03
Description: Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs due to inadequate handling of HTTP referrer headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84091; https://www.securityfocus.com/bid/59725
CVE: CVE-2[PII_REDACTED]
Published: 2020-02-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2016-4676
Published: 2020-02-03
Description: A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/Oct/89; http://www.securityfocus.com/bid/93851; http://www.securitytracker.com/id/1037087
CVE: CVE-2019-18567
Published: 2020-02-03
Description: Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362, CWE-125
References: https://airbus-cyber-security.com/dive-into-a-kernel-bromium-race-condition-cve-2019-18567; https://support.bromium.com/s/article/Bromium-Secure-Platform-4-1-Update-7-Released; https://airbus-cyber-security.com/dive-into-a-kernel-bromium-race-condition-cve-2019-18567
CVE: CVE-2019-20174
Published: 2020-02-03
Description: Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://auth0.com/docs/security/bulletins/cve-2019-20174; https://github.com/auth0/lock/releases/tag/v11.21.0; https://auth0.com/docs/security/bulletins/cve-2019-20174
CVE: CVE-2019-9501
Published: 2020-02-03
Description: The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
CVSS Score: 7.9 (HIGH)
CWE: CWE-122, CWE-787
References: https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html; https://kb.cert.org/vuls/id/166939/; https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
CVE: CVE-2019-9502
Published: 2020-02-03
Description: The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
CVSS Score: 7.9 (HIGH)
CWE: CWE-122, CWE-787
References: https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html; https://kb.cert.org/vuls/id/166939/; https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
CVE: CVE-2020-8591
Published: 2020-02-03
Description: eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712improper-access-control_3.html; https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712improper-access-control_3.html
CVE: CVE-2020-8592
Published: 2020-02-03
Description: eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712-sql-injection-lead-to_56.html; https://pyaefromucsp.blogspot.com/2020/02/eg-manager-v712-sql-injection-lead-to_56.html
CVE: CVE-2020-8597
Published: 2020-02-03
Description: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00006.html; http://packetstormsecurity.com/files/156662/pppd-2.4.8-Buffer-Overflow.html; http://packetstormsecurity.com/files/156802/pppd-2.4.8-Buffer-Overflow.html
CVE: CVE-2020-5235
Published: 2020-02-04
Description: There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memory when expanding the array nanopb can end up calling `free()` on a pointer value that comes from uninitialized memory. Depending on platform this can result in a crash or further memory corruption, which may be exploitable in some cases. This problem is fixed in nanopb-0.4.1, nanopb-0.3.9.5, nanopb-0.2.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/nanopb/nanopb/commit/45582f1f97f49e2abfdba1463d1e1027682d9856; https://github.com/nanopb/nanopb/commit/7b396821ddd06df8e39143f16e1dc0a4645b89a3; https://github.com/nanopb/nanopb/commit/aa9d0d1ca78d6adec3adfeecf3a706c7f9df81f2
CVE: CVE-2020-5236
Published: 2020-02-04
Description: Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f; https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc; https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f
CVE: CVE-2020-3937
Published: 2020-02-04
Description: SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910013; https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215; https://tvn.twcert.org.tw/taiwanvn/TVN-201910013
CVE: CVE-2020-3938
Published: 2020-02-04
Description: SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910014; https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215; https://tvn.twcert.org.tw/taiwanvn/TVN-201910014
CVE: CVE-2020-3939
Published: 2020-02-04
Description: SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910015; https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215; https://tvn.twcert.org.tw/taiwanvn/TVN-201910015
CVE: CVE-2011-3629
Published: 2020-02-04
Description: Joomla! core 1.7.1 allows information disclosure due to weak encryption
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://www.openwall.com/lists/oss-security/2012/03/02/4; http://www.openwall.com/lists/oss-security/2012/03/02/8; http://www.openwall.com/lists/oss-security/2012/03/28/6
CVE: CVE-2011-4937
Published: 2020-02-04
Description: Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/03/02/1; http://www.openwall.com/lists/oss-security/2012/03/02/4; http://www.openwall.com/lists/oss-security/2012/03/28/6
CVE: CVE-2011-4912
Published: 2020-02-04
Description: Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://developer.joomla.org/security/news/[PII_REDACTED]3-core-com-mailto-timeout-issue.html; https://www.openwall.com/lists/oss-security/2011/12/25/9; https://developer.joomla.org/security/news/[PII_REDACTED]3-core-com-mailto-timeout-issue.html
CVE: CVE-2012-5618
Published: 2020-02-04
Description: Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://www.openwall.com/lists/oss-security/2012/12/04/1; https://github.com/ushahidi/Ushahidi_Web/commit/e8c7ecd42818c331db8945d20f8b1865bc6d157e; http://www.openwall.com/lists/oss-security/2012/12/04/1
CVE: CVE-2012-5686
Published: 2020-02-04
Description: ZPanel 10.0.1 has insufficient entropy for its password reset process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-798
References: http://www.securityfocus.com/bid/56400; https://exchange.xforce.ibmcloud.com/vulnerabilities/79841; http://www.securityfocus.com/bid/56400
CVE: CVE-2013-1422
Published: 2020-02-04
Description: webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2013/07/22/8; http://www.openwall.com/lists/oss-security/2013/07/25/4; https://www.securityfocus.com/bid/58250/info
CVE: CVE-2013-7051
Published: 2020-02-04
Description: D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt; http://www.exploit-db.com/exploits/31425; https://exchange.xforce.ibmcloud.com/vulnerabilities/90904
CVE: CVE-2013-7052
Published: 2020-02-04
Description: D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/90902; https://www.securityfocus.com/bid/65290
CVE: CVE-2013-7053
Published: 2020-02-04
Description: D-Link DIR-100 4.03B07: cli.cgi CSRF
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/90905; https://www.securityfocus.com/bid/65290/info
CVE: CVE-2013-7054
Published: 2020-02-04
Description: D-Link DIR-100 4.03B07: cli.cgi XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/90906; https://www.securityfocus.com/bid/65290/info
CVE: CVE-2013-7055
Published: 2020-02-04
Description: D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/90903; https://www.securityfocus.com/bid/65290/info
CVE: CVE-2013-2676
Published: 2020-02-04
Description: Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/121553/Brother-MFC-9970CDW-Firmware-0D-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/84090; https://www.securityfocus.com/bid/59726
CVE: CVE-2013-2678
Published: 2020-02-04
Description: Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submit_type parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html; http://www.exploit-db.com/exploits/25292; http://www.securityfocus.com/bid/59710
CVE: CVE-2019-19968
Published: 2020-02-04
Description: PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://k4m1ll0.com/cve-2019-19968.html; https://pandorafms.com; https://k4m1ll0.com/cve-2019-19968.html
CVE: CVE-2019-9674
Published: 2020-02-04
Description: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html; https://bugs.python.org/issue36260
CVE: CVE-2019-19273
Published: 2020-02-04
Description: On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL2 implementation) allows arbitrary memory write operations. The Samsung ID is SVE-2019-16265.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://census-labs.com/news/2020/10/08/samsung-hypervisor-rkp-arbitrary-zero-write/; https://security.samsungmobile.com/securityUpdate.smsb; https://census-labs.com/news/2020/10/08/samsung-hypervisor-rkp-arbitrary-zero-write/
CVE: CVE-2019-4451
Published: 2020-02-04
Description: IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163493; https://www.ibm.com/support/pages/node/1288720; https://exchange.xforce.ibmcloud.com/vulnerabilities/163493
CVE: CVE-2019-4540
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 165813.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165813; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/165813
CVE: CVE-2019-4541
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165814; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/165814
CVE: CVE-2019-4548
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 165950.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165950; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/165950
CVE: CVE-2019-4550
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 165952.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165952; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/165952
CVE: CVE-2019-4551
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 165953.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165953; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/165953
CVE: CVE-2019-4562
Published: 2020-02-04
Description: IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. IBM X-Force ID: 166623.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166623; https://www.ibm.com/support/pages/node/1288660; https://exchange.xforce.ibmcloud.com/vulnerabilities/166623
CVE: CVE-2019-4674
Published: 2020-02-04
Description: IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 171510.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171510; https://www.ibm.com/support/pages/node/1288714; https://exchange.xforce.ibmcloud.com/vulnerabilities/171510
CVE: CVE-2019-4675
Published: 2020-02-04
Description: IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171511; https://www.ibm.com/support/pages/node/1288714; https://exchange.xforce.ibmcloud.com/vulnerabilities/171511
CVE: CVE-2020-4163
Published: 2020-02-04
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be misinterpreted as jsp content and executed. IBM X-Force ID: 174397.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174397; https://www.ibm.com/support/pages/node/1288786; https://exchange.xforce.ibmcloud.com/vulnerabilities/174397
CVE: CVE-2020-7221
Published: 2020-02-04
Description: mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafely, as demonstrated by a symlink attack on a chmod 04755 of auth_pam_tool_dir/auth_pam_tool. NOTE: this does not affect the Oracle MySQL product, which implements mysql_install_db differently.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://bugzilla.suse.com/show_bug.cgi?id=1160868; https://github.com/MariaDB/server/commit/9d18b[PII_REDACTED]c8324bf3e20e234e08ac45618; https://seclists.org/oss-sec/2020/q1/55