deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11622
Published: 2019-04-30
Description: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_edit_titre.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/itodaro/doorGets_cve; https://github.com/itodaro/doorGets_cve
CVE: CVE-2019-11623
Published: 2019-04-30
Description: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configuration siteweb) could exploit the vulnerability to obtain database sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/itodaro/doorGets_cve; https://github.com/itodaro/doorGets_cve
CVE: CVE-2019-11624
Published: 2019-04-30
Description: doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/itodaro/doorGets_cve; https://github.com/itodaro/doorGets_cve
CVE: CVE-2019-11625
Published: 2019-04-30
Description: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnerability to obtain database sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/itodaro/doorGets_cve; https://github.com/itodaro/doorGets_cve
CVE: CVE-2019-11626
Published: 2019-04-30
Description: routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-21
References: https://github.com/itodaro/doorGets_cve; https://github.com/itodaro/doorGets_cve
CVE: CVE-2019-3925
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-78
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3926
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-78
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3927
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.100.3.2.8.1 and iso.3.6.1.4.1.3212.100.3.2.8.2 OIDs. A remote, unauthenticated attacker can use this vulnerability to change the admin or moderator user's password and gain access to restricted areas on the HTTP interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-287
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3928
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7.4 OIDs. A remote, unauthenticated attacker can use this vulnerability to access a restricted presentation or to become the presenter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3929
Published: 2019-04-30
Description: The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-78
References: http://packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.html; http://packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.html; https://www.exploit-db.com/exploits/46786/
CVE: CVE-2019-3930
Published: 2019-04-30
Description: The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to a stack buffer overflow in libAwgCgi.so's PARSERtoCHAR function. A remote, unauthenticated attacker can use this vulnerability to execute arbitrary code as root via a crafted request to the return.cgi endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3931
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to argumention injection to the curl binary via crafted HTTP requests to return.cgi. A remote, authenticated attacker can use this vulnerability to upload files to the device and ultimately execute code as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-88, CWE-88
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3932
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A remote, unauthenticated attacker can use this vulnerability to control external devices via the uart_bridge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-249, CWE-798
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3933
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to watch a slideshow without knowing the access code.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-425
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3934
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-425
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3935
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi. A remote, unauthenticated attacker can use this vulnerability to start, stop, and disconnect active slideshows.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3936
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389. The request will force the slideshow to transition into a "stopped" state. A remote, unauthenticated attacker can use this vulnerability to stop an active slideshow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3937
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in cleartext in the file /tmp/scfgdndf. A local attacker can use this vulnerability to recover sensitive data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3938
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any configuration file since all the encryption logic is hard coded. A local attacker can use this vulnerability to gain access to devices username and passwords.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-798
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-3939
Published: 2019-04-30
Description: Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface. An unauthenticated, remote attacker can use these credentials to gain privileged access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-16, CWE-798
References: https://www.tenable.com/security/research/tra-2019-20; https://www.tenable.com/security/research/tra-2019-20
CVE: CVE-2019-0194
Published: 2019-04-30
Description: Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2019/04/30/2; http://www.securityfocus.com/bid/108181; https://lists.apache.org/thread.html/0a163d02169d3d361150e8183df4af33f1a3d8a419b2937ac8e6c66f%40%3Cusers.camel.apache.org%3E
CVE: CVE-2019-0213
Published: 2019-04-30
Description: In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://archiva.apache.org/security.html#CVE-2019-0213; http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html; http://www.openwall.com/lists/oss-security/2019/04/30/7
CVE: CVE-2019-0214
Published: 2019-04-30
Description: In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
CVSS Score: 6.5 (MEDIUM)
References: http://archiva.apache.org/security.html#CVE-2019-0214; http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html; http://www.openwall.com/lists/oss-security/2019/04/30/8
CVE: CVE-2019-11627
Published: 2019-04-30
Description: gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00029.html; https://bugs.debian.org/928256; https://lists.debian.org/debian-lts-announce/2019/05/msg00001.html
CVE: CVE-2019-11628
Published: 2019-05-01
Description: An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
CVSS Score: 8.2 (HIGH)
CWE: CWE-917
References: https://qliksupport.force.com/articles/000069985; https://qliksupport.force.com/articles/000069985
CVE: CVE-2019-11631
Published: 2019-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-11632
Published: 2019-05-01
Description: In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://github.com/OctopusDeploy/Issues/issues/5528; https://github.com/OctopusDeploy/Issues/issues/5529; https://github.com/OctopusDeploy/Issues/issues/5528
CVE: CVE-2019-11633
Published: 2019-05-01
Description: HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/dustyfresh/HoneyPress/issues/1; https://github.com/dustyfresh/HoneyPress/issues/1
CVE: CVE-2018-1608
Published: 2019-05-01
Description: IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 143798.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/108290; https://exchange.xforce.ibmcloud.com/vulnerabilities/143798; https://www.ibm.com/support/docview.wss?uid=ibm10882778
CVE: CVE-2018-1933
Published: 2019-05-01
Description: IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10879407; http://www.securityfocus.com/bid/108191; https://exchange.xforce.ibmcloud.com/vulnerabilities/153177
CVE: CVE-2019-4258
Published: 2019-05-01
Description: IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159946.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10880591; http://www.securityfocus.com/bid/108188; https://exchange.xforce.ibmcloud.com/vulnerabilities/159946
CVE: CVE-2019-11636
Published: 2019-05-01
Description: Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "Sapling Wood-Chipper" attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://github.com/zcash/zcash/issues/3955; https://saplingwoodchipper.github.io; https://twitter.com/dukeleto/status/[PII_REDACTED]18232066
CVE: CVE-2018-17606
Published: 2019-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-16620. Reason: This candidate is a reservation duplicate of CVE-2018-16620. Notes: All CVE users should reference CVE-2018-16620 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-3791
Published: 2019-05-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-11637
Published: 2019-05-01
Description: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a, leading to a crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-476
References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/rec2csv; https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils
CVE: CVE-2019-11638
Published: 2019-05-01
Description: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-476
References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/rec2csv; https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils
CVE: CVE-2019-11639
Published: 2019-05-01
Description: An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in librec.a.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/recfix; https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils
CVE: CVE-2019-11640
Published: 2019-05-01
Description: An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in librec.a.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils/; https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/recfix; https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutils/
CVE: CVE-2019-11641
Published: 2019-05-01
Description: Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size within HTML templates, giving attackers the ability to detect and avoid this system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://github.com/threatstream/agave/issues/1; https://github.com/threatstream/agave/issues/1
CVE: CVE-2019-10954
Published: 2019-05-01
Description: An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/108118; https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
CVE: CVE-2019-6562
Published: 2019-05-01
Description: In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://ics-cert.us-cert.gov/advisories/ICSMA-19-120-01; https://ics-cert.us-cert.gov/advisories/ICSMA-19-120-01
CVE: CVE-2019-10952
Published: 2019-05-01
Description: An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering 

CompactLogix 5370 L1, L2, and L3 Controllers, Compact GuardLogix 5370 controllers, and Armor Compact GuardLogix 5370 Controllers Versions 20 - 30 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400, CWE-787
References: http://www.securityfocus.com/bid/108118; https://ics-cert.us-cert.gov/advisories/ICSA-19-120-01; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1075979
CVE: CVE-2018-8035
Published: 2019-05-01
Description: This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108195; https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E; https://uima.apache.org/security_report
CVE: CVE-2019-0227
Published: 2019-05-01
Description: A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://lists.apache.org/thread.html/r3a5baf5d76f1f2181be7f54da3deab70d7a38b5660b387583d05a8cd%40%3Cjava-user.axis.apache.org%3E; https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E; https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/
CVE: CVE-2019-11675
Published: 2019-05-02
Description: The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://bugs.debian.org/928304; https://bugs.debian.org/928304
CVE: CVE-2019-11676
Published: 2019-05-02
Description: The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/firewall/release-notes.html; https://www.manageengine.com/products/firewall/release-notes.html
CVE: CVE-2019-11677
Published: 2019-05-02
Description: The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.manageengine.com/products/firewall/release-notes.html; https://www.manageengine.com/products/firewall/release-notes.html