deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8994
Published: 2020-03-05
Description: An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-8994.md; https://www.usenix.org/sites/default/files/soups2018posters-lau.pdf; https://youtu.be/yCadG38yZW8
CVE: CVE-2020-9418
Published: 2020-03-05
Description: An untrusted search path vulnerability in the installer of PDFescape Desktop version 4.0.22 and earlier allows an attacker to gain privileges and execute code via DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://support.pdfescape.com/hc/en-us/articles/[PII_REDACTED]51; https://support.pdfescape.com/hc/en-us/articles/[PII_REDACTED]51
CVE: CVE-2019-17642
Published: 2020-03-05
Description: An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-352
References: https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html; https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html; https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html
CVE: CVE-2019-17645
Published: 2020-03-05
Description: An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
CVE: CVE-2020-5250
Published: 2020-03-05
Description: In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-285, CWE-552
References: https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3; https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069
CVE: CVE-2019-14886
Published: 2020-03-05
Description: A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14886; https://groups.google.com/forum/?utm_medium=email&utm_source=footer#%21msg/jbpm-usage/74pSuwfGKRU/0oXpmRScBQAJ; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14886
CVE: CVE-2019-20382
Published: 2020-03-05
Description: QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
CVSS Score: 3.5 (LOW)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html; http://www.openwall.com/lists/oss-security/2020/03/05/1; https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
CVE: CVE-2020-10180
Published: 2020-03-05
Description: The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-436
References: https://blog.zoller.lu/p/tzo-11-2020-eset-generic-malformed.html; https://blog.zoller.lu/p/tzo-11-2020-eset-generic-malformed.html
CVE: CVE-2020-4082
Published: 2020-03-05
Description: The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075447
CVE: CVE-2020-4083
Published: 2020-03-05
Description: HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075503; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0075503
CVE: CVE-2020-5405
Published: 2020-03-05
Description: Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://pivotal.io/security/cve-2020-5405; https://pivotal.io/security/cve-2020-5405
CVE: CVE-2019-17646
Published: 2020-03-05
Description: An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
CVE: CVE-2019-17647
Published: 2020-03-05
Description: An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2
CVE: CVE-2019-20502
Published: 2020-03-05
Description: An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/s1kr10s/EasyChatServer-DOS; https://github.com/s1kr10s/EasyChatServer-DOS
CVE: CVE-2020-5957
Published: 2020-03-05
Description: NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with local system access can corrupt a system file, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4996; https://nvidia.custhelp.com/app/answers/detail/a_id/4996
CVE: CVE-2020-6971
Published: 2020-03-05
Description: In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges due to insecure configuration parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-269
References: https://www.us-cert.gov/ics/advisories/icsa-20-063-01; https://www.us-cert.gov/ics/advisories/icsa-20-063-01
CVE: CVE-2020-6986
Published: 2020-03-05
Description: In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.us-cert.gov/ics/advisories/icsa-20-063-03; https://www.us-cert.gov/ics/advisories/icsa-20-063-03
CVE: CVE-2020-10184
Published: 2020-03-05
Description: The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40; https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html; https://www.yubico.com/support/security-advisories/ysa-2020-01/
CVE: CVE-2020-10185
Published: 2020-03-05
Description: The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.
CVSS Score: 8.6 (HIGH)
CWE: CWE-294
References: https://github.com/Yubico/yubikey-val/releases/tag/yubikey-val-2.40; https://lists.debian.org/debian-lts-announce/2020/03/msg00014.html; https://www.yubico.com/support/security-advisories/ysa-2020-01/
CVE: CVE-2020-7975
Published: 2020-03-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-10188
Published: 2020-03-06
Description: utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html; https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216; https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html
CVE: CVE-2020-9756
Published: 2020-03-06
Description: Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privileges to read/write 1/2/4 bytes from or to an IO port. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://www.coresecurity.com/advisories/viper-rgb-driver-multiple-vulnerabilities; https://www.coresecurity.com/advisories/viper-rgb-driver-multiple-vulnerabilities
CVE: CVE-2020-10189
Published: 2020-03-06
Description: Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html; https://cwe.mitre.org/data/definitions/502.html; https://srcincite.io/advisories/src-2020-0011/
CVE: CVE-2020-9530
Published: 2020-03-06
Description: An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView component of Messaging(com.android.MMS) and loading malicious web pages, information leakage can occur. This is fixed on version: 2001122; 11.0.1.54.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://sec.xiaomi.com/post/180; https://www.zerodayinitiative.com/advisories/ZDI-20-289/; https://sec.xiaomi.com/post/180
CVE: CVE-2020-9531
Published: 2020-03-06
Description: An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user's unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122.
CVSS Score: 7.3 (HIGH)
References: https://sec.xiaomi.com/post/180; https://www.zerodayinitiative.com/advisories/ZDI-20-287/; https://www.zerodayinitiative.com/advisories/ZDI-20-288/
CVE: CVE-2020-8113
Published: 2020-03-06
Description: GitLab 10.7 and later through 12.7.2 has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/; https://about.gitlab.com/releases/categories/releases/; https://gitlab.com/gitlab-org/gitlab/issues/31599
CVE: CVE-2020-9454
Published: 2020-03-06
Description: A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers; https://wpvulndb.com/vulnerabilities/10116; https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
CVE: CVE-2020-9455
Published: 2020-03-06
Description: The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers; https://wpvulndb.com/vulnerabilities/10116; https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
CVE: CVE-2020-9456
Published: 2020-03-06
Description: In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers; https://wpvulndb.com/vulnerabilities/10116; https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
CVE: CVE-2020-9457
Published: 2020-03-06
Description: The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers; https://wpvulndb.com/vulnerabilities/10116; https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
CVE: CVE-2020-9458
Published: 2020-03-06
Description: In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers; https://wpvulndb.com/vulnerabilities/10116; https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
CVE: CVE-2019-20503
Published: 2020-03-06
Description: usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00030.html
CVE: CVE-2020-10193
Published: 2020-03-06
Description: ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: https://blog.zoller.lu/p/from-low-hanging-fruit-department_13.html; https://blog.zoller.lu/p/from-low-hanging-fruit-department_13.html
CVE: CVE-2020-7212
Published: 2020-03-06
Description: The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/urllib3/urllib3/blob/master/CHANGES.rst; https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a; https://pypi.org/project/urllib3/1.25.8/
CVE: CVE-2020-10110
Published: 2020-03-06
Description: Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive information disclosure through the cache headers on Citrix ADC. The "Via" header lists cache protocols and recipients between the start and end points for a request or a response. The "Age" header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive
CVSS Score: 5.3 (MEDIUM)
References: http://packetstormsecurity.com/files/156656/Citrix-Gateway-11.1-12.0-12.1-Information-Disclosure.html; https://seclists.org/fulldisclosure/2020/Mar/7; https://support.citrix.com/search
CVE: CVE-2020-10111
Published: 2020-03-06
Description: Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. Citrix ADC only caches HTTP/1.1 traffic for performance optimization
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://packetstormsecurity.com/files/156661/Citrix-Gateway-11.1-12.0-12.1-Cache-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/11; https://support.citrix.com/search
CVE: CVE-2020-10112
Published: 2020-03-06
Description: Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444
References: http://packetstormsecurity.com/files/156660/Citrix-Gateway-11.1-12.0-12.1-Cache-Poisoning.html; http://seclists.org/fulldisclosure/2020/Mar/8; https://support.citrix.com/search
CVE: CVE-2020-5327
Published: 2020-03-06
Description: Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.dell.com/support/article/SLN320536; https://www.dell.com/support/article/SLN320536
CVE: CVE-2020-5328
Published: 2020-03-06
Description: Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability; https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability
CVE: CVE-2019-19772
Published: 2020-03-06
Description: Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US
CVE: CVE-2019-19773
Published: 2020-03-06
Description: Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US
CVE: CVE-2017-14203
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2017-14204
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2017-14205
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2017-14206
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2017-14207
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2017-14208
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2017
CVE: CVE-2019-14499
Published: 2020-03-07
Description: Rejected reason: Unused CVE for 2019