deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14296
Published: 2019-07-27
Description: canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00007.html; https://github.com/upx/upx/issues/287
CVE: CVE-2007-6762
Published: 2019-07-27
Description: In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2a2f11c227bdf292b3a2900ad04139d301b56ac4; https://github.com/torvalds/linux/commit/2a2f11c227bdf292b3a2900ad04139d301b56ac4; https://mirrors.edge.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20
CVE: CVE-2010-5331
Published: 2019-07-27
Description: In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-5331; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0031c41be5c529f8329e327b63cde92ba1284842; https://github.com/torvalds/linux/commit/0031c41be5c529f8329e327b63cde92ba1284842
CVE: CVE-2010-5332
Published: 2019-07-27
Description: In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0926f91083f34d047abc74f1ca4fa6a9c161f7db; https://github.com/torvalds/linux/commit/0926f91083f34d047abc74f1ca4fa6a9c161f7db; https://mirrors.edge.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37
CVE: CVE-2011-5327
Published: 2019-07-27
Description: In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=12f09ccb4612734a53e47ed5302e0479c10a50f8; https://github.com/torvalds/linux/commit/12f09ccb4612734a53e47ed5302e0479c10a50f8; https://mirrors.edge.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
CVE: CVE-2012-6712
Published: 2019-07-27
Description: In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2da424b0773cea3db47e1e81db71eeebde8269d4; https://github.com/torvalds/linux/commit/2da424b0773cea3db47e1e81db71eeebde8269d4; https://mirrors.edge.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4
CVE: CVE-2015-9289
Published: 2019-07-27
Description: In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fa2337a315a2448c5434f41e00d56b01a22283c; https://github.com/torvalds/linux/commit/1fa2337a315a2448c5434f41e00d56b01a22283c; https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
CVE: CVE-2016-10764
Published: 2019-07-27
Description: In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=193e87143c290ec16838f5368adc0e0bc94eb931; https://github.com/torvalds/linux/commit/193e87143c290ec16838f5368adc0e0bc94eb931; https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6
CVE: CVE-2017-18379
Published: 2019-07-27
Description: In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0c319d3a144d4b8f1ea2047fd614d2149b68f889; https://github.com/torvalds/linux/commit/0c319d3a144d4b8f1ea2047fd614d2149b68f889; https://support.f5.com/csp/article/K74012105
CVE: CVE-2019-14297
Published: 2019-07-27
Description: Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/46767; https://www.exploit-db.com/exploits/46767
CVE: CVE-2019-14298
Published: 2019-07-27
Description: Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/46766; https://www.exploit-db.com/exploits/46766
CVE: CVE-2019-14315
Published: 2019-07-28
Description: A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sunhater/kcfinder/issues/180; https://github.com/sunhater/kcfinder/issues/180
CVE: CVE-2019-14322
Published: 2019-07-28
Description: In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html; https://palletsprojects.com/blog/werkzeug-0-15-5-released/; http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
CVE: CVE-2019-14323
Published: 2019-07-28
Description: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193, CWE-787
References: https://github.com/troglobit/ssdp-responder/commit/ce04b1f29a137198182f60bbb628d5ceb8171765; https://github.com/troglobit/ssdp-responder/issues/1; https://github.com/troglobit/ssdp-responder/commit/ce04b1f29a137198182f60bbb628d5ceb8171765
CVE: CVE-2019-14328
Published: 2019-07-28
Description: The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153801/WordPress-Simple-Membership-3.8.4-Cross-Site-Request-Forgery.html; https://wordpress.org/plugins/simple-membership/#developers; https://wpvulndb.com/vulnerabilities/9482
CVE: CVE-2019-14329
Published: 2019-07-28
Description: An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.cinquino.eu/EspoCRM.htm; https://github.com/espocrm/espocrm/commit/4ab7d[PII_REDACTED]b875abd3eef1e1f6f75289e2; https://github.com/espocrm/espocrm/compare/5.6.5...5.6.6
CVE: CVE-2019-14330
Published: 2019-07-28
Description: An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.cinquino.eu/EspoCRM.htm; https://github.com/espocrm/espocrm/commit/4ab7d[PII_REDACTED]b875abd3eef1e1f6f75289e2; https://github.com/espocrm/espocrm/compare/5.6.5...5.6.6
CVE: CVE-2019-14331
Published: 2019-07-28
Description: An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.cinquino.eu/EspoCRM.htm; https://github.com/espocrm/espocrm/commit/4ab7d[PII_REDACTED]b875abd3eef1e1f6f75289e2; https://github.com/espocrm/espocrm/compare/5.6.5...5.6.6
CVE: CVE-2019-14349
Published: 2019-07-28
Description: EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/espocrm/espocrm/issues/1358; https://github.com/espocrm/espocrm/issues/1358
CVE: CVE-2019-14350
Published: 2019-07-28
Description: EspoCRM 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the Knowledge base. A malicious attacker can inject JavaScript code in the body parameter during api/v1/KnowledgeBaseArticle knowledge-base record creation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/espocrm/espocrm/issues/1356; https://github.com/espocrm/espocrm/issues/1356
CVE: CVE-2019-14351
Published: 2019-07-28
Description: EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-307
References: https://github.com/espocrm/espocrm/issues/1357; https://github.com/espocrm/espocrm/issues/1357
CVE: CVE-2019-14352
Published: 2019-07-28
Description: In Joget Workflow 6.0.20, CSV Injection, also known as Formula Injection, exists, as demonstrated by jw/web/userview/crm_community/crm_userview_sales/_/account_new with the Account ID or Account Name field. NOTE: the vendor disputes the relevance of this finding because CSV is not the intended export format for spreadsheet applications
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://github.com/jogetworkflow/jw-community/issues/20; https://github.com/jogetworkflow/jw-community/issues/20
CVE: CVE-2019-14362
Published: 2019-07-28
Description: Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://grep.blog/directory-traversal-openbravo/; https://issues.openbravo.com/view.php?id=41413; https://www.sitincloud.com/securite/directory-traversal-openbravo-erp/
CVE: CVE-2019-14363
Published: 2019-07-28
Description: A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/reevesrs24/CVE/blob/master/Netgear_WNDR2400v3/upnp_stack_overflow/upnp_stack_overflow.md; https://github.com/reevesrs24/CVE/blob/master/Netgear_WNDR2400v3/upnp_stack_overflow/upnp_stack_overflow.md
CVE: CVE-2019-14364
Published: 2019-07-28
Description: An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ivoschyk-cs/CVE-s/blob/master/Email%20Subscribers%20%26%20Newsletters%20Wordpress%20Plugin%20%28XSS%29; https://wordpress.org/plugins/email-subscribers/#developers; https://wpvulndb.com/vulnerabilities/9508
CVE: CVE-2019-14368
Published: 2019-07-28
Description: Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/issues/952; https://github.com/Exiv2/exiv2/issues/952
CVE: CVE-2019-14369
Published: 2019-07-28
Description: Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/issues/953; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html; https://github.com/Exiv2/exiv2/issues/953
CVE: CVE-2019-14370
Published: 2019-07-28
Description: In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/issues/954; https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html; https://github.com/Exiv2/exiv2/issues/954
CVE: CVE-2019-14371
Published: 2019-07-28
Description: An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c, related to offset and tag.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.libav.org/show_bug.cgi?id=1163; https://bugzilla.libav.org/show_bug.cgi?id=1163
CVE: CVE-2019-14372
Published: 2019-07-28
Description: In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.libav.org/show_bug.cgi?id=1165; https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html; https://bugzilla.libav.org/show_bug.cgi?id=1165
CVE: CVE-2019-14373
Published: 2019-07-28
Description: An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a heap-based buffer over-read in libpng via a crafted flif file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/FLIF-hub/FLIF/issues/541; https://github.com/FLIF-hub/FLIF/issues/541
CVE: CVE-2019-14378
Published: 2019-07-29
Description: ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-755, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
CVE: CVE-2019-14379
Published: 2019-07-29
Description: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: http://seclists.org/fulldisclosure/2022/Mar/23; https://access.redhat.com/errata/RHBA-2019:2824; https://access.redhat.com/errata/RHSA-2019:2743
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: yard before 0.9.20 allows path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr; https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html; https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Misskey before 10.102.4 allows hijacking a user's token.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p; https://github.com/syuilo/misskey/security/advisories/GHSA-6qw9-6jxq-xj3p
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
CVSS Score: 7.2 (HIGH)
CWE: CWE-669
References: https://github.com/Charcoal-SE/SmokeDetector/security/advisories/GHSA-5w85-7mwr-v44q; https://github.com/Charcoal-SE/SmokeDetector/security/advisories/GHSA-5w85-7mwr-v44q
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: parse-server before 3.4.1 allows DoS after any POST to a volatile class.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq; https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: parse-server before 3.6.0 allows account enumeration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5; https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: docker-credential-helpers before 0.6.3 has a double free in the List functions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/docker/docker-credential-helpers/commit/1c9f7ede70a5ab9851f4c9cb37d317fd89cd318a; https://github.com/docker/docker-credential-helpers/releases/tag/v0.6.3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VVFB6UWUK2GQQN7DVUU6GRRAL637A73/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
CVSS Score: 7.5 (HIGH)
References: https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac; https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: ASH-AIO before 2.0.0.3 allows an open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/ASHTeam/ash-aio-2/security/advisories/GHSA-cg3m-qj5v-8g48; https://github.com/ASHTeam/ash-aio-2/security/advisories/GHSA-cg3m-qj5v-8g48
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a; https://github.com/discourse/discourse/commit/e6e47f2fb22764c92aaa90445c7bf203192fba11; https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/discourse/discourse/commit/52387be4a44cdeaca5421ee955ba1343e836bade; https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a; https://github.com/discourse/discourse/commit/52387be4a44cdeaca5421ee955ba1343e836bade
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: invenio-previewer before 1.0.0a12 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c; https://github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c
CVE: CVE-2019-1105
Published: 2019-07-29
Description: A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim.
The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user.
The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1105; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1105
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8; https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: invenio-records before 1.2.2 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j; https://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Tridactyl before 1.16.0 allows fake key events.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/tridactyl/tridactyl/security/advisories/GHSA-7qr7-93pf-hr8f; https://github.com/tridactyl/tridactyl/security/advisories/GHSA-7qr7-93pf-hr8f
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: invenio-communities before 1.0.0a20 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-mfv8-q39f-mgfg; https://github.com/inveniosoftware/invenio-communities/security/advisories/GHSA-mfv8-q39f-mgfg
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: invenio-app before 1.1.1 allows host header injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://github.com/inveniosoftware/invenio-app/security/advisories/GHSA-94mf-xfg5-r247; https://github.com/inveniosoftware/invenio-app/security/advisories/GHSA-94mf-xfg5-r247
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Dependency-Track before 3.5.1 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-jp9v-w6vw-9m5v; https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-jp9v-w6vw-9m5v
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: stacktable.js before 1.0.4 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/WebFirst/stacktable.js/security/advisories/GHSA-r9j3-hgxr-75xg; https://github.com/WebFirst/stacktable.js/security/advisories/GHSA-r9j3-hgxr-75xg
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-29
Description: Fleet before 2.1.2 allows exposure of SMTP credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/kolide/fleet/security/advisories/GHSA-6g7f-8qm4-f7h8; https://github.com/kolide/fleet/security/advisories/GHSA-6g7f-8qm4-f7h8
CVE: CVE-2019-12613
Published: 2019-07-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a security issue in customer-controlled software. Notes: recovery of a public key is not a security concern as per its public nature