deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19578
Published: 2019-07-10
Description: GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Tracing Operations page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54228; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2018-19579
Published: 2019-07-10
Description: GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/53917; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2018-19580
Published: 2019-07-10
Description: All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/39809; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2018-19581
Published: 2019-07-10
Description: GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user to set the weight of an issue they create.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/7696; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2018-19582
Published: 2019-07-10
Description: GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/8180; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2018-19583
Published: 2019-07-10
Description: GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting administrators with access to the logs to see another user's token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: http://www.securityfocus.com/bid/109166; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-workhorse/issues/182
CVE: CVE-2018-19584
Published: 2019-07-10
Description: GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated, but unauthorized, users to view members and milestone details of private groups.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/52522; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2019-12469
Published: 2019-07-10
Description: MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html; https://phabricator.wikimedia.org/T222036; https://seclists.org/bugtraq/2019/Jun/12
CVE: CVE-2019-12470
Published: 2019-07-10
Description: Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html; https://phabricator.wikimedia.org/T222038; https://seclists.org/bugtraq/2019/Jun/12
CVE: CVE-2019-13122
Published: 2019-07-10
Description: A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jk.ozlabs.org/projects/patchwork/; http://www.openwall.com/lists/oss-security/2019/07/05/1; https://github.com/getpatchwork/patchwork/commits/master
CVE: CVE-2019-13276
Published: 2019-07-10
Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated user to execute arbitrary code by providing a sufficiently long query string when POSTing to any valid cgi, txt, asp, or js file. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13276; https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13276
CVE: CVE-2019-13278
Published: 2019-07-10
Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13278; https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13278
CVE: CVE-2019-13279
Published: 2019-07-10
Description: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup wizard, allowing an unauthenticated user to execute arbitrary code. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13279; https://github.com/fuzzywalls/TRENDNetExploits/tree/master/CVE-2019-13279
CVE: CVE-2018-11734
Published: 2019-07-10
Description: In e107 v2.1.7, output without filtering results in XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/e107inc/e107/issues/3170; https://github.com/e107inc/e107/issues/3170
CVE: CVE-2019-10966
Published: 2019-07-10
Description: In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/109102; https://www.us-cert.gov/ics/advisories/icsma-19-190-01; http://www.securityfocus.com/bid/109102
CVE: CVE-2019-1873
Published: 2019-07-10
Description: A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reboot unexpectedly. The vulnerability is due to incomplete input validation of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) ingress packet header. An attacker could exploit this vulnerability by sending a crafted TLS/SSL packet to an interface on the targeted device. An exploit could allow the attacker to cause the device to reload, which will result in a denial of service (DoS) condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid SSL or TLS session is required to exploit this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-20
References: http://www.securityfocus.com/bid/109123; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190710-asa-ftd-dos; http://www.securityfocus.com/bid/109123
CVE: CVE-2019-5220
Published: 2019-07-10
Description: There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker could do a certain operation on certain step of setup wizard. Successful exploit could allow the attacker bypass the FRP protection. Affected products: Mate 20 X, versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1); Mate 20, versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1); Honor Magic 2, versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190626-01-frp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190626-01-frp-en
CVE: CVE-2019-5221
Published: 2019-07-10
Description: There is a path traversal vulnerability on Huawei Share. The software does not properly validate the path, an attacker could crafted a file path when transporting file through Huawei Share, successful exploit could allow the attacker to transport a file to arbitrary path on the phone. Affected products: Mate 20 X versions earlier than Ever-L29B 9.1.0.300(C432E3R1P12), versions earlier than Ever-L29B 9.1.0.300(C636E3R2P1), and versions earlier than Ever-L29B 9.1.0.300(C185E3R3P1).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190703-01-share-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190703-01-share-en
CVE: CVE-2019-0281
Published: 2019-07-10
Description: SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109077; https://launchpad.support.sap.com/#/notes/2756539; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0318
Published: 2019-07-10
Description: Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/109069; https://launchpad.support.sap.com/#/notes/2738791; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0319
Published: 2019-07-10
Description: The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-79
References: http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html; http://www.securityfocus.com/bid/109074; https://cxsecurity.com/ascii/WLB[PII_REDACTED]
CVE: CVE-2019-0321
Published: 2019-07-10
Description: ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109078; https://launchpad.support.sap.com/#/notes/2773888; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0322
Published: 2019-07-10
Description: SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/109076; https://launchpad.support.sap.com/#/notes/2781873; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-11650
Published: 2019-07-10
Description: A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0.
CVSS Score: 5.9 (MEDIUM)
References: https://www.netiq.com/documentation/advanced-authentication-60/advanced-authentication-releasenotes-60/data/advanced-authentication-releasenotes-60.html#t49vfiy1udvg; https://www.netiq.com/documentation/advanced-authentication-60/advanced-authentication-releasenotes-60/data/advanced-authentication-releasenotes-60.html#t49vfiy1udvg
CVE: CVE-2019-13132
Published: 2019-07-10
Description: In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00033.html; http://www.openwall.com/lists/oss-security/2019/07/08/6; http://www.securityfocus.com/bid/109284
CVE: CVE-2019-0325
Published: 2019-07-10
Description: SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/109075; https://launchpad.support.sap.com/#/notes/2798133; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0326
Published: 2019-07-10
Description: SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109072; https://launchpad.support.sap.com/#/notes/2764733; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0327
Published: 2019-07-10
Description: SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/109071; https://launchpad.support.sap.com/#/notes/2777910; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0328
Published: 2019-07-10
Description: ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/109067; https://launchpad.support.sap.com/#/notes/2774489; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0329
Published: 2019-07-10
Description: SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109070; https://launchpad.support.sap.com/#/notes/2804833; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-0330
Published: 2019-07-10
Description: The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/109068; https://launchpad.support.sap.com/#/notes/2808158; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
CVE: CVE-2019-12803
Published: 2019-07-10
Description: In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can upload a webshell. After the webshell upload, an attacker can use the webshell to perform remote code exection such as running a system command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35073; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35073
CVE: CVE-2019-12804
Published: 2019-07-10
Description: In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft malicious file and use it as an update.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-353, CWE-345
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35073; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35073
CVE: CVE-2019-13481
Published: 2019-07-10
Description: An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/109131; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-3.pdf; http://www.securityfocus.com/bid/109131
CVE: CVE-2019-13482
Published: 2019-07-10
Description: An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/109131; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-4.pdf; http://www.securityfocus.com/bid/109131
CVE: CVE-2019-5444
Published: 2019-07-10
Description: Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/569966; https://hackerone.com/reports/569966
CVE: CVE-2019-5445
Published: 2019-07-10
Description: DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7; https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7
CVE: CVE-2019-5446
Published: 2019-07-10
Description: Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7; https://community.ui.com/releases/EdgeMAX-EdgeSwitch-Firmware-v1-8-2/824d58b1-6027-49cf-878d-2076c01948b7
CVE: CVE-2019-13381
Published: 2019-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-13488
Published: 2019-07-10
Description: A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI, because the jQuery prepend() method is used.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jofpin/trape/issues/169; https://github.com/jofpin/trape/issues/169
CVE: CVE-2019-13489
Published: 2019-07-10
Description: Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jofpin/trape/issues/168; https://github.com/jofpin/trape/issues/168
CVE: CVE-2019-13503
Published: 2019-07-11
Description: mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing/; https://github.com/cesanta/mongoose/pull/1035; https://fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing/
CVE: CVE-2019-13504
Published: 2019-07-11
Description: There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/109117; https://fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing/; https://github.com/Exiv2/exiv2/pull/943
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-11
Description: Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/leanote/leanote/issues/719; https://github.com/leanote/leanote/issues/719
CVE: CVE-2019-12838
Published: 2019-07-11
Description: SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html
CVE: CVE-2019-13505
Published: 2019-07-11
Description: The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ivoschyk-cs/CVE-s/blob/master/Appointment%20Hour%20Booking%20%E2%80%93%20WordPress%20Booking%20Plugin%20--%20stored%20XSS; https://wordpress.org/plugins/appointment-hour-booking/#developers; https://wpvulndb.com/vulnerabilities/9458
CVE: CVE-2018-11744
Published: 2019-07-11
Description: Cloudera Manager through 5.15 has Incorrect Access Control.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#cloudera_manager; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html