deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15635
Published: 2019-09-23
Description: An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-319, CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167244; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://exchange.xforce.ibmcloud.com/vulnerabilities/167244
CVE: CVE-2019-11277
Published: 2019-09-23
Description: Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-90, CWE-74
References: https://www.cloudfoundry.org/blog/cve-2019-11277; https://www.cloudfoundry.org/blog/cve-2019-11277
CVE: CVE-2019-1255
Published: 2019-09-23
Description: A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1255; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1255
CVE: CVE-2019-1367
Published: 2019-09-23
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1367
CVE: CVE-2019-10754
Published: 2019-09-23
Description: Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
CVSS Score: 8.1 (HIGH)
CWE: CWE-338
References: https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402; https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404; https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406
CVE: CVE-2019-10755
Published: 2019-09-23
Description: The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-338
References: https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407; https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407
CVE: CVE-2019-16728
Published: 2019-09-24
Description: DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html; https://research.securitum.com/dompurify-bypass-using-mxss/; https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
CVE: CVE-2019-16729
Published: 2019-09-24
Description: pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.
CVSS Score: 7.8 (HIGH)
References: https://bugzilla.suse.com/show_bug.cgi?id=1150510#c1; https://lists.debian.org/debian-lts-announce/2019/11/msg00020.html; https://sourceforge.net/p/pam-python/code/ci/0247ab687b4347cc52859ca461fb0126dd7e2ebe/
CVE: CVE-2019-16746
Published: 2019-09-24
Description: An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-16748
Published: 2019-09-24
Description: In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer over-read in CheckCertSignature_ex in wolfcrypt/src/asn.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/wolfSSL/wolfssl/issues/2459; https://github.com/wolfSSL/wolfssl/issues/2459
CVE: CVE-2018-9090
Published: 2019-09-24
Description: CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://coreos.com/tectonic/releases/; https://coreos.com/tectonic/releases/#1.8.7-tectonic.2; https://coreos.com/tectonic/releases/
CVE: CVE-2019-4515
Published: 2019-09-24
Description: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 165137.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165137; https://www.ibm.com/support/pages/node/290671; https://exchange.xforce.ibmcloud.com/vulnerabilities/165137
CVE: CVE-2019-4566
Published: 2019-09-24
Description: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166627; https://www.ibm.com/support/pages/node/1074344; https://exchange.xforce.ibmcloud.com/vulnerabilities/166627
CVE: CVE-2019-13355
Published: 2019-09-24
Description: In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773; https://www.totaldefense.com/security-blog; https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773
CVE: CVE-2019-13356
Published: 2019-09-24
Description: In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773; https://www.totaldefense.com/security-blog; https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773
CVE: CVE-2019-13357
Published: 2019-09-24
Description: In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.dll, which leads to code execution. SYSTEM-level code execution can be achieved when the ccSchedulerSVC service runs the affected executable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/DLL%20Hijacking/v9.0.0.773; https://www.totaldefense.com/security-blog; https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/DLL%20Hijacking/v9.0.0.773
CVE: CVE-2019-16383
Published: 2019-09-24
Description: MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html; https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability; https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm
CVE: CVE-2019-3726
Published: 2019-09-24
Description: An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.dell.com/support/article/SLN318693; https://www.dell.com/support/article/SLN318693
CVE: CVE-2019-14753
Published: 2019-09-24
Description: SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/medias/SCA-2019-002.pdf?context=bWFzdGVyfGNvbnRlbnR8MjE5MDk1fGFwcGxpY2F0aW9uL3BkZnxjb250ZW50L2g3Yy9oNDEvMTAzMDY0NjAzNTI1NDIucGRmfDJlZTVmZjJmYzYwYmQ1ODQyZDBmMjA0OTc3ZDBjMmY1YzZkYzUzNzI0MWI0OGIyOTE0OTllY2VlYjJhNzUzYTE; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2019-14238
Published: 2019-09-24
Description: On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via the Instruction Tightly Coupled Memory (ITCM) bus.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.usenix.org/conference/woot19/presentation/schink; https://www.usenix.org/system/files/woot19-paper_schink.pdf; https://www.usenix.org/conference/woot19/presentation/schink
CVE: CVE-2019-16751
Published: 2019-09-24
Description: An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback_render method in the omniauth callbacks controller.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/lynndylanhurley/devise_token_auth/issues/1332; https://github.com/lynndylanhurley/devise_token_auth/issues/1332
CVE: CVE-2019-16754
Published: 2019-09-24
Description: RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/RIOT-OS/RIOT/pull/12293; https://github.com/RIOT-OS/RIOT/pull/12293
CVE: CVE-2019-14239
Published: 2019-09-24
Description: On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.usenix.org/conference/woot19/presentation/schink; https://www.usenix.org/system/files/woot19-paper_schink.pdf; https://www.usenix.org/conference/woot19/presentation/schink
CVE: CVE-2019-12068
Published: 2019-09-24
Description: In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
CVSS Score: 3.8 (LOW)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html; https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de594e[PII_REDACTED]6bbf9391efb79da0a1a08e08
CVE: CVE-2019-15699
Published: 2019-09-24
Description: An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of the HSHelloExtensions part of the packet.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://lists.openinfosecfoundation.org/pipermail/oisf-announce/; https://suricata-ids.org/2019/09/24/suricata-4-1-5-released/; https://lists.openinfosecfoundation.org/pipermail/oisf-announce/
CVE: CVE-2019-16410
Published: 2019-09-24
Description: An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to access a memory region that is not allocated, because of a lack of header_len checking.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://lists.openinfosecfoundation.org/pipermail/oisf-announce/; https://suricata-ids.org/2019/09/24/suricata-4-1-5-released/; https://www.code-intelligence.com/cve-2019-16410
CVE: CVE-2019-16411
Published: 2019-09-24
Description: An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimestamp in decode-ipv4.c tries to access a memory region that is not allocated. There is a check for o->len < 5 (corresponding to 2 bytes of header and 3 bytes of data). Then, "flag = *(o->data + 3)" places one beyond the 3 bytes, because the code should have been "flag = *(o->data + 1)" instead.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://lists.openinfosecfoundation.org/pipermail/oisf-announce/; https://suricata-ids.org/2019/09/24/suricata-4-1-5-released/; https://www.code-intelligence.com/cve-2019-16411
CVE: CVE-2019-5504
Published: 2019-09-24
Description: ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to perform administrative actions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-5505
Published: 2019-09-24
Description: ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-522
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14220
Published: 2019-09-24
Description: An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM) to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method runs with System admin privilege and if given the file name as parameter returns you the content of file. A malicious app using the affected method can then read the content of any system file which it is not authorized to read
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]91-Release-Notes; https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]32-BlueStacks-fails-to-restrict-access-permissions; https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]91-Release-Notes
CVE: CVE-2019-16724
Published: 2019-09-24
Description: File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow in an HTTP POST parameter, a similar issue to CVE-2010-2330 and CVE-2010-2331.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://packetstormsecurity.com/files/154586/File-Sharing-Wizard-1.5.0-SEH-Buffer-Overflow.html; http://packetstormsecurity.com/files/154777/File-Sharing-Wizard-1.5.0-POST-SEH-Overflow.html; https://www.exploit-db.com/exploits/47412
CVE: CVE-2019-16725
Published: 2019-09-24
Description: In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-logo-parameter-of-default-templates.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-logo-parameter-of-default-templates.html
CVE: CVE-2019-13527
Published: 2019-09-24
Description: In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-05; https://www.zerodayinitiative.com/advisories/ZDI-19-993/; https://www.us-cert.gov/ics/advisories/icsa-19-213-05
CVE: CVE-2019-13528
Published: 2019-09-24
Description: A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-285
References: https://www.us-cert.gov/ics/advisories/icsa-19-262-01; https://www.us-cert.gov/ics/advisories/icsa-19-262-01
CVE: CVE-2019-16759
Published: 2019-09-24
Description: vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html; http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html; http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html
CVE: CVE-2019-5094
Published: 2019-09-24
Description: An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787, CWE-787
References: https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
CVE: CVE-2019-16867
Published: 2019-09-25
Description: HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Neeke/HongCMS/issues/12; https://github.com/Neeke/HongCMS/issues/12
CVE: CVE-2019-16868
Published: 2019-09-25
Description: emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in the bak[] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/emlog/emlog/issues/48; https://github.com/emlog/emlog/issues/48
CVE: CVE-2019-13627
Published: 2019-09-25
Description: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html; http://www.openwall.com/lists/oss-security/2019/10/02/2
CVE: CVE-2019-10401
Published: 2019-09-25
Description: In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/09/25/3; https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1498; http://www.openwall.com/lists/oss-security/2019/09/25/3
CVE: CVE-2019-10402
Published: 2019-09-25
Description: In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/09/25/3; https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1525; http://www.openwall.com/lists/oss-security/2019/09/25/3
CVE: CVE-2019-10403
Published: 2019-09-25
Description: Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/09/25/3; https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20%281%29; http://www.openwall.com/lists/oss-security/2019/09/25/3