deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10900
Published: 2019-04-09
Description: In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/107836; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15612
CVE: CVE-2019-10901
Published: 2019-04-09
Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE: CVE-2019-10902
Published: 2019-04-09
Description: In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/107836; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15619
CVE: CVE-2019-10903
Published: 2019-04-09
Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE: CVE-2019-10630
Published: 2019-04-09
Description: A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]; http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]
CVE: CVE-2019-10631
Published: 2019-04-09
Description: Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]; http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]
CVE: CVE-2019-10632
Published: 2019-04-09
Description: A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]; http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]
CVE: CVE-2019-10633
Published: 2019-04-09
Description: An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]; http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]
CVE: CVE-2019-10634
Published: 2019-04-09
Description: An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]; http://maxwelldulin.com/BlogPost?post=[PII_REDACTED]
CVE: CVE-2019-11028
Published: 2019-04-09
Description: GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx".
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/152643/GAT-Ship-Web-Module-Unrestricted-File-Upload.html; http://seclists.org/fulldisclosure/2019/Apr/33; https://seclists.org/fulldisclosure/2019/Apr/14
CVE: CVE-2017-17544
Published: 2019-04-09
Description: A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_admin via restoring modified configurations.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/107839; https://fortiguard.com/advisory/FG-IR-17-053; http://www.securityfocus.com/bid/107839
CVE: CVE-2018-15631
Published: 2019-04-09
Description: Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/32516; https://www.excellium-services.com/cert-xlm-advisory/cve-2018-15631/; https://github.com/odoo/odoo/issues/32516
CVE: CVE-2018-15635
Published: 2019-04-09
Description: Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitrary web script in the browser of an internal user of the system by tricking them into inviting a follower on a document with a crafted name.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/odoo/odoo/issues/32515; https://github.com/odoo/odoo/issues/32515
CVE: CVE-2018-15640
Published: 2019-04-09
Description: Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-863
References: https://github.com/odoo/odoo/issues/32514; https://github.com/odoo/odoo/issues/32514
CVE: CVE-2019-10242
Published: 2019-04-09
Description: In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/107844; https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835; http://www.securityfocus.com/bid/107844
CVE: CVE-2019-10243
Published: 2019-04-09
Description: In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497, CWE-200
References: http://www.securityfocus.com/bid/107844; https://bugs.eclipse.org/bugs/show_bug.cgi?id=545834; http://www.securityfocus.com/bid/107844
CVE: CVE-2019-10244
Published: 2019-04-09
Description: In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/107844; https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835; http://www.securityfocus.com/bid/107844
CVE: CVE-2019-3795
Published: 2019-04-09
Description: Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330, CWE-330
References: http://www.securityfocus.com/bid/107802; https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html; https://pivotal.io/security/cve-2019-3795
CVE: CVE-2019-3870
Published: 2019-04-09
Description: A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3870; https://bugzilla.samba.org/show_bug.cgi?id=13834; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/
CVE: CVE-2019-3880
Published: 2019-04-09
Description: A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.html; https://access.redhat.com/errata/RHSA-2019:1966
CVE: CVE-2019-3887
Published: 2019-04-09
Description: A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-863, CWE-863
References: http://www.securityfocus.com/bid/107850; https://access.redhat.com/errata/RHSA-2019:2703; https://access.redhat.com/errata/RHSA-2019:2741
CVE: CVE-2019-3893
Published: 2019-04-09
Description: In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-732, CWE-732
References: http://www.openwall.com/lists/oss-security/2019/04/14/2; http://www.securityfocus.com/bid/107846; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893
CVE: CVE-2019-3940
Published: 2019-04-09
Description: Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/107847; https://www.tenable.com/security/research/tra-2019-15; http://www.securityfocus.com/bid/107847
CVE: CVE-2019-3941
Published: 2019-04-09
Description: Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/107847; https://www.tenable.com/security/research/tra-2019-15; http://www.securityfocus.com/bid/107847
CVE: CVE-2019-5615
Published: 2019-04-09
Description: Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50; https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50
CVE: CVE-2018-13366
Published: 2019-04-09
Description: An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.com/advisory/FG-IR-18-101; https://fortiguard.com/advisory/FG-IR-18-101
CVE: CVE-2018-19589
Published: 2019-04-09
Description: Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in external key storage. This compromises the availability of all keys configured with external key storage and may result in an economic attack in which the attacker denies legitimate users access to keys while maintaining possession of an encrypted copy (blob) of the external key store for ransom. This attack has been dubbed reverse ransomware attack and may be executed via a physical connection to the CryptoServer or remote connection if SSH or remote access to LAN CryptoServer has been compromised. The Confidentiality and Integrity of the affected keys, however, remain untarnished.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://support.hsm.utimaco.com/support/security-advisories/-/blogs/cve-2018-19589; https://www.linkedin.com/pulse/does-hsm-guarantee-cryptographic-key-security-kwadjo-nyante/; https://support.hsm.utimaco.com/support/security-advisories/-/blogs/cve-2018-19589
CVE: CVE-2017-17023
Published: 2019-04-09
Description: The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded version of NCP "Secure Entry Client" 10.11 r32792. A vulnerability in the software update feature of the VPN client allows a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker to execute arbitrary, malicious software on a target user's computer. This is related to SIC_V11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_31799.exe (NCP), and ncpmon.exe (both Sophos and NCP). The vulnerability exists because: (1) the VPN client requests update metadata over an insecure HTTP connection; and (2) the client software does not check if the software update is signed before running it.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: https://www.ncp-e.com/en/resources/download-vpn-client/#c8680; https://www.ncp-e.com/fileadmin/pdf/service_support/release_notes/NCP_Secure_Clients/NCP_Secure_Entry_Client/NCP_RN_Win_Secure_Entry_Client_11_14_r42039_en.pdf; https://www.ncp-e.com/en/resources/download-vpn-client/#c8680
CVE: CVE-2017-3139
Published: 2019-04-09
Description: A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://access.redhat.com/security/cve/cve-2017-3139; https://bugzilla.redhat.com/show_bug.cgi?id=1447743; https://access.redhat.com/security/cve/cve-2017-3139
CVE: CVE-2018-14894
Published: 2019-04-09
Description: CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute blocked applications.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/152489/CyberArk-EPM-10.2.1.603-Security-Restrictions-Bypass.html; https://mustafakemalcan.com/cyberark-epm-file-block-bypass-cve-2018-14894/; https://www.exploit-db.com/exploits/46688/
CVE: CVE-2018-19586
Published: 2019-04-09
Description: Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the underlying system with privileges of the user running the application. Especially, an attacker may leverage the vulnerability to write an executable JSP file in an exposed web directory to execute commands on the underlying system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89; https://www.bishopfox.com/news/2019/01/silverpeas-5-15-to-6-0-2-path-traversal/; https://github.com/Silverpeas/Silverpeas-Core/blob/d8c3bbb0695a4907db013401bd16c6527e2b4f41/core-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java#L89
CVE: CVE-2018-20698
Published: 2019-04-09
Description: The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://docs.search-guard.com/latest/changelog-kibana-6.x-16; https://github.com/floragunncom/search-guard-kibana-plugin/pull/140; https://docs.search-guard.com/latest/changelog-kibana-6.x-16
CVE: CVE-2019-6117
Published: 2019-04-09
Description: The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://earthmanet.github.io/2019/01/05/Wordpress%20plugin%20Gallery%20Images%20Ape%201.6.14-Stored%20Cross-Site%20Scripting/; https://earthmanet.github.io/2019/01/05/Wordpress%20plugin%20Gallery%20Images%20Ape%201.6.14-Stored%20Cross-Site%20Scripting/
CVE: CVE-2019-7174
Published: 2019-04-09
Description: Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations.
CVSS Score: 9.8 (CRITICAL)
References: https://alicangonullu.biz/konu/2; https://alicangonullu.biz/konu/2
CVE: CVE-2019-8990
Published: 2019-04-09
Description: The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/107840; http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-9-2019-tibco-activematrix-businessworks
CVE: CVE-2019-9133
Published: 2019-04-09
Description: When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-191
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7/; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991
CVE: CVE-2019-9134
Published: 2019-04-09
Description: Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34993; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34993
CVE: CVE-2018-18507
Published: 2019-04-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2018-16530
Published: 2019-04-09
Description: A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service. While no known Remote Code Execution (RCE) vulnerabilities exist, as with all buffer overflows, the possibility of RCE cannot be completely ruled out. Data Execution Protection (DEP) is already enabled on the Email appliance as a risk mitigation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://help.forcepoint.com/security/CVE/CVE-2018-16530.html; https://support.forcepoint.com/KBArticle?id=000016621; https://help.forcepoint.com/security/CVE/CVE-2018-16530.html
CVE: CVE-2018-7117
Published: 2019-04-09
Description: A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03907en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03917en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03907en_us
CVE: CVE-2018-7118
Published: 2019-04-09
Description: A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version 2018.09.0.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03904en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03904en_us
CVE: CVE-2018-18365
Published: 2019-04-09
Description: Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVSS Score: 7.5 (HIGH)
References: https://support.symantec.com/en_US/article.SYMSA1475.html; https://support.symantec.com/en_US/article.SYMSA1475.html
CVE: CVE-2019-1567
Published: 2019-04-09
Description: The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security.paloaltonetworks.com/CVE-2019-1567; https://security.paloaltonetworks.com/CVE-2019-1567
CVE: CVE-2019-5511
Published: 2019-04-09
Description: VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately. Successful exploitation of this issue may allow the path to the VMX executable, on a Windows host, to be hijacked by a non-administrator leading to elevation of privilege.
CVSS Score: 8.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2019-0002.html; https://www.vmware.com/security/advisories/VMSA-2019-0002.html