deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0830
Published: 2019-04-09
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0830; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0830
CVE: CVE-2019-0831
Published: 2019-04-09
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0831; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0831
CVE: CVE-2019-0833
Published: 2019-04-09
Description: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107704; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0833; http://www.securityfocus.com/bid/107704
CVE: CVE-2019-0835
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scripting Engine Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835
CVE: CVE-2019-0836
Published: 2019-04-09
Description: An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0841.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: http://packetstormsecurity.com/files/152538/Microsoft-Windows-LUAFV-PostLuafvPostReadWrite-SECTION_OBJECT_POINTERS-Race-Condition.html; http://www.securityfocus.com/bid/107719; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0836
CVE: CVE-2019-0837
Published: 2019-04-09
Description: An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0837; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0837
CVE: CVE-2019-0838
Published: 2019-04-09
Description: An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0839.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0838; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0838
CVE: CVE-2019-0839
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0838.
CVSS Score: 4.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0839; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0839
CVE: CVE-2019-0840
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0844.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0840; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0840
CVE: CVE-2019-0841
Published: 2019-04-09
Description: An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html; http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html; http://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html
CVE: CVE-2019-0842
Published: 2019-04-09
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107725; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0842; http://www.securityfocus.com/bid/107725
CVE: CVE-2019-0844
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0840.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0844; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0844
CVE: CVE-2019-0845
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0845; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0845
CVE: CVE-2019-0846
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0847, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0846; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0846
CVE: CVE-2019-0847
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0847; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0847
CVE: CVE-2019-0848
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0814.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0848; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0848
CVE: CVE-2019-0849
Published: 2019-04-09
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0802.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0849; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0849
CVE: CVE-2019-0851
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0877, CVE-2019-0879.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0851; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0851
CVE: CVE-2019-0853
Published: 2019-04-09
Description: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-824
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0853; https://www.zerodayinitiative.com/advisories/ZDI-19-362/; https://www.zerodayinitiative.com/advisories/ZDI-19-363/
CVE: CVE-2019-0856
Published: 2019-04-09
Description: A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.
CVSS Score: 7.2 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0856; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0856
CVE: CVE-2019-0857
Published: 2019-04-09
Description: A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: http://www.securityfocus.com/bid/107760; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0857; http://www.securityfocus.com/bid/107760
CVE: CVE-2019-0858
Published: 2019-04-09
Description: A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0858; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0858
CVE: CVE-2019-0859
Published: 2019-04-09
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0859
CVE: CVE-2019-0860
Published: 2019-04-09
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0861.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107722; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0860; http://www.securityfocus.com/bid/107722
CVE: CVE-2019-0861
Published: 2019-04-09
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107724; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0861; http://www.securityfocus.com/bid/107724
CVE: CVE-2019-0862
Published: 2019-04-09
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0752, CVE-2019-0753.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107727; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0862; http://www.securityfocus.com/bid/107727
CVE: CVE-2019-0866
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107749; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866; http://www.securityfocus.com/bid/107749
CVE: CVE-2019-0867
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107752; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0867; http://www.securityfocus.com/bid/107752
CVE: CVE-2019-0868
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0870, CVE-2019-0871.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107753; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0868; http://www.securityfocus.com/bid/107753
CVE: CVE-2019-0869
Published: 2019-04-09
Description: A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107768; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0869; http://www.securityfocus.com/bid/107768
CVE: CVE-2019-0870
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0871.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107754; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0870; http://www.securityfocus.com/bid/107754
CVE: CVE-2019-0871
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0870.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107755; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0871; http://www.securityfocus.com/bid/107755
CVE: CVE-2019-0874
Published: 2019-04-09
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107759; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0874; http://www.securityfocus.com/bid/107759
CVE: CVE-2019-0875
Published: 2019-04-09
Description: An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0875; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0875
CVE: CVE-2019-0876
Published: 2019-04-09
Description: An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107743; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0876; http://www.securityfocus.com/bid/107743
CVE: CVE-2019-0877
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0879.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0877; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0877
CVE: CVE-2019-0879
Published: 2019-04-09
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0877.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/107741; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0879; http://www.securityfocus.com/bid/107741
CVE: CVE-2019-3842
Published: 2019-04-09
Description: In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".
CVSS Score: 7.0 (HIGH)
CWE: CWE-285, CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html; http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842
CVE: CVE-2019-5585
Published: 2019-04-09
Description: An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via modifying the contents of a file used by several FortiClientMac processes.
CVSS Score: 6.1 (MEDIUM)
References: http://www.securityfocus.com/bid/107693; https://fortiguard.com/advisory/FG-IR-19-003; http://www.securityfocus.com/bid/107693
CVE: CVE-2019-6140
Published: 2019-04-09
Description: A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://help.forcepoint.com/security/CVE/CVE-2019-6140.html; https://help.forcepoint.com/security/CVE/CVE-2019-6140.html
CVE: CVE-2019-8456
Published: 2019-04-09
Description: Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to successfully connect to a site-to-site VPN server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk149892; https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk149892
CVE: CVE-2019-9696
Published: 2019-04-09
Description: Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107692; https://support.symantec.com/en_US/article.SYMSA1477.html; http://www.securityfocus.com/bid/107692
CVE: CVE-2019-1573
Published: 2019-04-09
Description: GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user.
CVSS Score: 2.5 (LOW)
CWE: CWE-226, CWE-311
References: http://www.securityfocus.com/bid/107868; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0005; https://security.paloaltonetworks.com/CVE-2019-1573
CVE: CVE-2019-11065
Published: 2019-04-10
Description: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVSS Score: 5.9 (MEDIUM)
References: https://github.com/gradle/gradle/pull/8927; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/
CVE: CVE-2018-20321
Published: 2019-04-10
Description: An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://forums.rancher.com/c/announcements; https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11/; https://forums.rancher.com/c/announcements
CVE: CVE-2019-10843
Published: 2019-04-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2018-1903
Published: 2019-04-10
Description: IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.
CVSS Score: 6.7 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10875386; https://exchange.xforce.ibmcloud.com/vulnerabilities/152532; http://www.ibm.com/support/docview.wss?uid=ibm10875386