deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5311
Published: 2020-01-03
Description: libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://access.redhat.com/errata/RHSA-2020:0566; https://access.redhat.com/errata/RHSA-2020:0580; https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3
CVE: CVE-2020-5312
Published: 2020-01-03
Description: libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://access.redhat.com/errata/RHSA-2020:0566; https://access.redhat.com/errata/RHSA-2020:0578; https://access.redhat.com/errata/RHSA-2020:0580
CVE: CVE-2020-5313
Published: 2020-01-03
Description: libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
CVE: CVE-2019-20330
Published: 2020-01-03
Description: FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2; https://github.com/FasterXML/jackson-databind/issues/2526; https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E
CVE: CVE-2019-19441
Published: 2020-01-03
Description: HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in the local area network (LAN) to exploit this vulnerability. Successful exploitation may cause information leak.
CVSS Score: 6.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-02-smartphone-en
CVE: CVE-2019-5304
Published: 2020-01-03
Description: Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-buffer-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-buffer-en
CVE: CVE-2020-1785
Published: 2020-01-03
Description: Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit could cause reboot of the smartphone.
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-03-smartphone-en
CVE: CVE-2020-1871
Published: 2020-01-03
Description: USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity.
CVSS Score: 8.2 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-credential-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-credential-en
CVE: CVE-2019-19086
Published: 2020-01-03
Description: Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19087
Published: 2020-01-03
Description: Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19088
Published: 2020-01-03
Description: Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19254
Published: 2020-01-03
Description: GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab/issues/12219
CVE: CVE-2019-19311
Published: 2020-01-03
Description: GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab/issues/31536
CVE: CVE-2012-4451
Published: 2020-01-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://framework.zend.com/security/advisory/ZF2012-03; http://seclists.org/oss-sec/2012/q3/571; http://seclists.org/oss-sec/2012/q3/573
CVE: CVE-2019-19255
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19256
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19257
Published: 2020-01-03
Description: GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19258
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19259
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19260
Published: 2020-01-03
Description: GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).
CVSS Score: 5.4 (MEDIUM)
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19261
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19262
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-19263
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19309
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-19310
Published: 2020-01-03
Description: GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE: CVE-2019-5063
Published: 2020-01-03
Description: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0852; https://www.oracle.com//security-alerts/cpujul2021.html; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2019-5064
Published: 2020-01-03
Description: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://github.com/opencv/opencv/issues/15857; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0853; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2019-11993
Published: 2020-01-03
Description: A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061675&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.
CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03955en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03955en_us
CVE: CVE-2019-11994
Published: 2020-01-03
Description: A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. An API is used to execute a command manifest file during upgrade does not correctly prevent directory traversal and so can be used to execute manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files. For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061901&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_us
CVE: CVE-2012-5693
Published: 2020-01-03
Description: Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to (1) remoteAttack.pl or (2) guessPassword.pl in frameworkgui/; the filename parameter to (3) CSAttack.pl or (4) SEAttack.pl in frameworkgui/; the phNo2Attack parameter to (5) CSAttack.pl or (6) SEAttack.pl in frameworkgui/; the (7) platformDD2 parameter to frameworkgui/SEAttack.pl; the (8) agentURLPath or (9) agentControlKey parameter to frameworkgui/attach2agents.pl; or the (10) controlKey parameter to frameworkgui/attachMobileModem.pl. NOTE: The hostingPath parameter to CSAttack.pl and SEAttack.pl vectors and the appURLPath parameter to attachMobileModem.pl vector are covered by CVE-2012-5878.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.htbridge.com/advisory/HTB23123; https://www.htbridge.com/advisory/HTB23123
CVE: CVE-2012-5878
Published: 2020-01-03
Description: Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.htbridge.com/advisory/HTB23123; https://www.htbridge.com/advisory/HTB23127; https://www.htbridge.com/advisory/HTB23123
CVE: CVE-2014-10398
Published: 2020-01-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client (aka RBS BS-Client. Retail Client) 2.5, 2.4, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) DICTIONARY, (2) FILTERIDENT, (3) FROMSCHEME, (4) FromPoint, or (5) FName_0 parameter and a valid sid parameter value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt; https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt
CVE: CVE-2014-4196
Published: 2020-01-03
Description: Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitrary web script or HTML via the colorstyle parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt; https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt
CVE: CVE-2014-5140
Published: 2020-01-03
Description: The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/128183/Loaded-Commerce-7-Shopping-Cart-SQL-Injection.html; http://resources.infosecinstitute.com/exploiting-systemic-query-vulnerabilities-attempt-re-invent-pdo/; http://www.exploit-db.com/exploits/34552
CVE: CVE-2014-5516
Published: 2020-01-03
Description: Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attackers to hijack the authentication of administrators for requests that change a user email address via an unspecified GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/128342/KonaKart-Storefront-Application-Cross-Site-Request-Forgery.html; http://www.christian-schneider.net/advisories/CVE-2014-5516.txt; http://www.konakart.com/downloads/ver-7-3-0-0-whats-new
CVE: CVE-2014-8337
Published: 2020-01-03
Description: Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/128979/HelpDEZk-1.0.1-Unrestricted-File-Upload.html; https://www.htbridge.com/advisory/HTB23239; http://packetstormsecurity.com/files/128979/HelpDEZk-1.0.1-Unrestricted-File-Upload.html
CVE: CVE-2020-5395
Published: 2020-01-03
Description: FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00041.html; https://github.com/fontforge/fontforge/issues/4084; https://lists.debian.org/debian-lts-announce/2024/03/msg00007.html
CVE: CVE-2014-8516
Published: 2020-01-03
Description: Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/70895; http://www.zerodayinitiative.com/advisories/ZDI-14-372/; https://exchange.xforce.ibmcloud.com/vulnerabilities/98475
CVE: CVE-2019-19959
Published: 2020-01-03
Description: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
CVSS Score: 7.5 (HIGH)
References: https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d[PII_REDACTED]49f69bec; https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-9537
Published: 2020-01-03
Description: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/
CVE: CVE-2019-9538
Published: 2020-01-03
Description: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/
CVE: CVE-2019-9539
Published: 2020-01-03
Description: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/
CVE: CVE-2019-9540
Published: 2020-01-03
Description: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/
CVE: CVE-2019-9541
Published: 2020-01-03
Description: : Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/
CVE: CVE-2019-9542
Published: 2020-01-03
Description: : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.kb.cert.org/vuls/id/873161/; https://www.kb.cert.org/vuls/id/873161/