deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10447
Published: 2019-10-16
Description: Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/10/16/6; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1431; http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE: CVE-2019-10448
Published: 2019-10-16
Description: Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432
CVE: CVE-2019-10449
Published: 2019-10-16
Description: Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1433; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1433
CVE: CVE-2019-10450
Published: 2019-10-16
Description: Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 3.3 (LOW)
CWE: CWE-312
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434
CVE: CVE-2019-10451
Published: 2019-10-16
Description: Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1439; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1439
CVE: CVE-2019-10452
Published: 2019-10-16
Description: Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1440; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1440
CVE: CVE-2019-10453
Published: 2019-10-16
Description: Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/10/16/6; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1450; http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE: CVE-2019-10454
Published: 2019-10-16
Description: A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460
CVE: CVE-2019-10455
Published: 2019-10-16
Description: A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1460
CVE: CVE-2019-10456
Published: 2019-10-16
Description: A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462
CVE: CVE-2019-10457
Published: 2019-10-16
Description: A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/10/16/6; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462; http://www.openwall.com/lists/oss-security/2019/10/16/6
CVE: CVE-2019-10458
Published: 2019-10-16
Description: Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
CVSS Score: 9.9 (CRITICAL)
References: https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918; https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918
CVE: CVE-2019-15893
Published: 2019-10-16
Description: Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
CVSS Score: 7.2 (HIGH)
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]94; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]94
CVE: CVE-2019-16520
Published: 2019-10-16
Description: The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/16/5; https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack; https://github.com/semperfiwebdesign/all-in-one-seo-pack/issues/2888
CVE: CVE-2019-17629
Published: 2019-10-16
Description: CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12146; https://forum.cmsmadesimple.org/viewforum.php?f=1; http://dev.cmsmadesimple.org/bug/view/12146
CVE: CVE-2019-17630
Published: 2019-10-16
Description: CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12149; https://forum.cmsmadesimple.org/viewforum.php?f=1; http://dev.cmsmadesimple.org/bug/view/12149
CVE: CVE-2019-16521
Published: 2019-10-16
Description: The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/16/3; https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_Checker; https://wordpress.org/plugins/broken-link-checker/#developers
CVE: CVE-2019-16522
Published: 2019-10-16
Description: The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law; https://wordpress.org/plugins/eu-cookie-law/#developers; https://wpvulndb.com/vulnerabilities/9918
CVE: CVE-2019-16523
Published: 2019-10-16
Description: The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/16/4; https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190913-03_WordPress_Plugin_Events_Manager; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2019-6334
Published: 2019-10-16
Description: HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Managed Printers have a solution to check application signature that may allow potential execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hp.com/us-en/document/c06447795; https://support.hp.com/us-en/document/c06447795
CVE: CVE-2019-11281
Published: 2019-10-16
Description: Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2020:0078; https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/
CVE: CVE-2019-17660
Published: 2019-10-16
Description: A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kbgsft/vuln-limesurvey/wiki/Reflected-XSS-in-LimeSurvey-3.19.1-by-xcuter; https://github.com/kbgsft/vuln-limesurvey/wiki/Reflected-XSS-in-LimeSurvey-3.19.1-by-xcuter
CVE: CVE-2018-2875
Published: 2019-10-16
Description: Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via OracleNet to compromise Core RDBMS. While the vulnerability is in Core RDBMS, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Core RDBMS accessible data. CVSS 3.0 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2018-3300
Published: 2019-10-16
Description: Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Internal Operations). The supported version that is affected is 7.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Xstore Office. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Office accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Office accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-17576
Published: 2019-10-16
Description: An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails to (instead of real recipients, for test purposes)" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mycvee.blogspot.com/p/blog-page.html; https://mycvee.blogspot.com/p/blog-page.html
CVE: CVE-2019-17577
Published: 2019-10-16
Description: An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for error returns emails (fields 'Errors-To' in emails sent)" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mycvee.blogspot.com/p/cve-2019-17576.html; https://mycvee.blogspot.com/p/cve-2019-17576.html
CVE: CVE-2019-17578
Published: 2019-10-16
Description: An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails (default value in php.ini: Undefined)" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mycvee.blogspot.com/p/cve-2019-17578.html; https://mycvee.blogspot.com/p/cve-2019-17578.html
CVE: CVE-2019-17662
Published: 2019-10-16
Description: ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-522
References: http://packetstormsecurity.com/files/154896/ThinVNC-1.0b1-Authentication-Bypass.html; https://github.com/bewest/thinvnc/issues/5; https://github.com/shashankmangal2/Exploits/blob/master/ThinVNC-RemoteAccess/POC.py
CVE: CVE-2019-17663
Published: 2019-10-16
Description: D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/zeroday/FG-VD-19-116; https://fortiguard.com/zeroday/FG-VD-19-116
CVE: CVE-2019-2734
Published: 2019-10-16
Description: Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session, Execute on DBMS_ADVISOR privilege with network access via OracleNet to compromise Core RDBMS. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Core RDBMS accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2765
Published: 2019-10-16
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 10 and 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L).
CVSS Score: 5.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2872
Published: 2019-10-16
Description: Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Point of Sale). Supported versions that are affected are 17.0.3, 18.0.1 and 19.0.0. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Point of Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).
CVSS Score: 2.7 (LOW)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2883
Published: 2019-10-16
Description: Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported version that is affected is 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Customer Management and Segmentation Foundation accessible data as well as unauthorized read access to a subset of Oracle Retail Customer Management and Segmentation Foundation accessible data. CVSS 3.0 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
CVSS Score: 4.6 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2884
Published: 2019-10-16
Description: Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported version that is affected is 17.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Customer Management and Segmentation Foundation accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 5.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2886
Published: 2019-10-16
Description: Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Forms, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Forms accessible data as well as unauthorized read access to a subset of Oracle Forms accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2887
Published: 2019-10-16
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2888
Published: 2019-10-16
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2889
Published: 2019-10-16
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2019-2890
Published: 2019-10-16
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html