deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-8312
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md
CVE: CVE-2019-8313
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv6.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv6.md
CVE: CVE-2019-8314
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md
CVE: CVE-2019-8315
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md
CVE: CVE-2019-8316
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md
CVE: CVE-2019-8317
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md
CVE: CVE-2019-8318
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md
CVE: CVE-2019-8319
Published: 2019-02-13
Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv4.md; https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv4.md
CVE: CVE-2018-20164
Published: 2019-02-13
Description: An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-185
References: https://github.com/ua-parser/uap-core/commit/010ccdc7303546cd22b9da687c29f4a996990014; https://github.com/ua-parser/uap-core/commit/156f7e12b215bddbaf3df4514c399d683e6cdadc; https://github.com/ua-parser/uap-core/issues/332
CVE: CVE-2018-15781
Published: 2019-02-13
Description: The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could reverse engineer the cryptographic system used in the Dell Wyse Password Encoder to discover the hard coded private key and decrypt locally stored cipher text.
CVSS Score: 7.9 (HIGH)
CWE: CWE-798
References: https://www.dell.com/support/article/SLN316104; https://www.dell.com/support/article/SLN316104
CVE: CVE-2019-3782
Published: 2019-02-13
Description: Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-522
References: http://www.securityfocus.com/bid/107038; https://www.cloudfoundry.org/blog/cve-2019-3782; http://www.securityfocus.com/bid/107038
CVE: CVE-2019-8334
Published: 2019-02-13
Description: An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS].
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gongfuxiang/schoolcms/issues/1; https://github.com/gongfuxiang/schoolcms/issues/1
CVE: CVE-2019-8335
Published: 2019-02-13
Description: An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS].
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gongfuxiang/schoolcms/issues/1; https://github.com/gongfuxiang/schoolcms/issues/1
CVE: CVE-2019-3610
Published: 2019-02-13
Description: Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key (TK) 3.1.9211.0 and earlier allows local users to expose confidential data via specially crafted malware.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/107217; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102889; http://www.securityfocus.com/bid/107217
CVE: CVE-2018-0696
Published: 2019-02-13
Description: OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: http://jvn.jp/en/jp/JVN49995005/index.html; https://www.cs.themistruct.com/report/wam20181012; https://www.osstech.co.jp/support/am2018-4-1-en
CVE: CVE-2018-12409
Published: 2019-02-13
Description: The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107024; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/02/tibco-security-advisory-february-13-2019-tibco-silver-fabric
CVE: CVE-2018-13403
Published: 2019-02-13
Description: The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-68526; https://jira.atlassian.com/browse/JRASERVER-68526
CVE: CVE-2018-13404
Published: 2019-02-13
Description: The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-918
References: https://jira.atlassian.com/browse/JRASERVER-68527; https://jira.atlassian.com/browse/JRASERVER-68527
CVE: CVE-2018-16189
Published: 2019-02-13
Description: Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN52168232/index.html; http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm; http://jvn.jp/en/jp/JVN52168232/index.html
CVE: CVE-2018-16190
Published: 2019-02-13
Description: Untrusted search path vulnerability in UNARJ32.DLL for Win32, LHMelting for Win32, and LMLzh32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier, LHMelting for Win32 Ver 1.65.3.6 and earlier, LMLzh32.DLL Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN52168232/index.html; http://micco.mars.jp/vul/2017/mhsvi20170515_02.htm; http://micco.mars.jp/vul/2017/mhsvi20170515_04.htm
CVE: CVE-2018-20232
Published: 2019-02-13
Description: The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107023; https://jira.atlassian.com/browse/JRASERVER-68614; http://www.securityfocus.com/bid/107023
CVE: CVE-2018-20237
Published: 2019-02-13
Description: Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://www.securityfocus.com/bid/107041; https://jira.atlassian.com/browse/CONFSERVER-57814; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20237/
CVE: CVE-2018-20238
Published: 2019-02-13
Description: Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via an insufficient session expiration vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: http://www.securityfocus.com/bid/107036; https://jira.atlassian.com/browse/CWD-5361; http://www.securityfocus.com/bid/107036
CVE: CVE-2019-5909
Published: 2019-02-13
Description: License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03)) allows remote attackers to bypass access restriction to send malicious files to the PC where License Manager Service runs via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://jvn.jp/vu/JVNVU99147082/index.html; http://www.securityfocus.com/bid/106772; https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf
CVE: CVE-2019-5910
Published: 2019-02-13
Description: Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN98505783/index.html; http://jvn.jp/en/jp/JVN98505783/index.html
CVE: CVE-2019-5911
Published: 2019-02-13
Description: Untrusted search path vulnerability in the installer of UNLHA32.DLL (UNLHA32.DLL for Win32 Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN83826673/index.html; http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm; http://jvn.jp/en/jp/JVN83826673/index.html
CVE: CVE-2019-5912
Published: 2019-02-13
Description: Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN83826673/index.html; http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm; http://jvn.jp/en/jp/JVN83826673/index.html
CVE: CVE-2019-5913
Published: 2019-02-13
Description: Untrusted search path vulnerability in the installer of LHMelting (LHMelting for Win32 Ver 1.65.3.6 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://jvn.jp/en/jp/JVN83826673/index.html; http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm; http://jvn.jp/en/jp/JVN83826673/index.html
CVE: CVE-2019-5914
Published: 2019-02-13
Description: V20 PRO L-01J software version L01J20c and L01J20d has a NULL pointer exception flaw that can be used by an attacker to cause the device to crash on the same network range via a specially crafted access point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: http://jvn.jp/en/jp/JVN40439414/index.html; https://www.nttdocomo.co.jp/support/utilization/product_update/list/l01j/index.html; http://jvn.jp/en/jp/JVN40439414/index.html
CVE: CVE-2019-5915
Published: 2019-02-13
Description: Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://jvn.jp/en/jp/JVN43193964/index.html; https://www.cs.themistruct.com/; https://www.osstech.co.jp/support/am2019-1-1
CVE: CVE-2019-5916
Published: 2019-02-13
Description: Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917
References: http://jvn.jp/en/jp/JVN63860183/index.html; https://poweregg.d-circle.com/support/package/important/20190204_000780/; http://jvn.jp/en/jp/JVN63860183/index.html
CVE: CVE-2019-8337
Published: 2019-02-13
Description: In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://gitlab.marlam.de/marlam/mpop/commit/b51a6c6b8b83bf0913cc52fa2ff64307e987a5b8; https://marlam.de/mpop/news/mpop-1-4-3/; https://marlam.de/msmtp/news/
CVE: CVE-2018-19008
Published: 2019-02-13
Description: The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wherein the application doesn't properly prevent the insertion of specially crafted files which could allow arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/106658; https://ics-cert.us-cert.gov/advisories/ICSA-19-017-02; http://www.securityfocus.com/bid/106658
CVE: CVE-2018-6267
Published: 2019-02-13
Description: NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software does not validate or incorrectly validates input that can affect the control flow or data flow of a program, which may lead to denial of service or escalation of privileges. Android ID: A-70857947.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106846; https://nvidia.custhelp.com/app/answers/detail/a_id/4787; https://nvidia.custhelp.com/app/answers/detail/a_id/4804
CVE: CVE-2018-6268
Published: 2019-02-13
Description: NVIDIA Tegra library contains a vulnerability in libnvmmlite_video.so, where referencing memory after it has been freed may lead to denial of service or possible escalation of privileges. Android ID: A-80433161.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106846; https://nvidia.custhelp.com/app/answers/detail/a_id/4787; https://nvidia.custhelp.com/app/answers/detail/a_id/4804
CVE: CVE-2018-6271
Published: 2019-02-13
Description: NVIDIA Tegra OpenMax driver (libnvomx) contains a vulnerability in which the software delivers extra data with the buffer and does not properly validated the extra data, which may lead to denial of service or escalation of privileges. Android ID: A-80198474.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106846; https://nvidia.custhelp.com/app/answers/detail/a_id/4787; https://nvidia.custhelp.com/app/answers/detail/a_id/4910
CVE: CVE-2019-6589
Published: 2019-02-14
Description: On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K23566124; https://support.f5.com/csp/article/K23566124
CVE: CVE-2019-8341
Published: 2019-02-15
Description: An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html; https://bugzilla.redhat.com/show_bug.cgi?id=1677653
CVE: CVE-2019-8343
Published: 2019-02-15
Description: In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392556; https://security.gentoo.org/glsa/202312-09; https://bugzilla.nasm.us/show_bug.cgi?id=3392556
CVE: CVE-2019-8345
Published: 2019-02-15
Description: The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used, and an attacker's web site is displayed in a WebView with no information about the URL.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-319
References: https://www.youtube.com/watch?v=BtLUO-ujJ7I; https://www.youtube.com/watch?v=BtLUO-ujJ7I
CVE: CVE-2019-6974
Published: 2019-02-15
Description: In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9; http://www.securityfocus.com/bid/107127; https://access.redhat.com/errata/RHBA-2019:0959
CVE: CVE-2019-8347
Published: 2019-02-15
Description: BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP accounts via the admin/admin_member.php?action=add&nav=add_web_user&admin_p_nav=user URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/source-trace/beescms/issues/4; https://github.com/source-trace/beescms/issues/4
CVE: CVE-2019-0251
Published: 2019-02-15
Description: The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106993; https://launchpad.support.sap.com/#/notes/2638175; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0254
Published: 2019-02-15
Description: SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107004; https://launchpad.support.sap.com/#/notes/2706798; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943