deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19851
Published: 2020-03-16
Description: An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Superfecta+Module; https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities; https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Superfecta+Module
CVE: CVE-2019-19940
Published: 2020-03-16
Description: Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute arbitrary commands via command injection.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt; https://www.swisscom.ch/en/residential/help/device/internet-router.html; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt
CVE: CVE-2019-19941
Published: 2020-03-16
Description: Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS service of the router via crafted hostnames in DHCP requests, causing XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt; https://www.swisscom.ch/en/residential/help/device/internet-router.html; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt
CVE: CVE-2019-19942
Published: 2020-03-16
Description: Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02.04 allows a remote attacker to perform DNS spoofing against the web interface via crafted hostnames in DHCP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt; https://www.swisscom.ch/en/residential/help/device/internet-router.html; https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2019-19940ff.txt
CVE: CVE-2019-4617
Published: 2020-03-16
Description: IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 168645.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168645; https://www.ibm.com/support/pages/node/5737689; https://exchange.xforce.ibmcloud.com/vulnerabilities/168645
CVE: CVE-2019-4619
Published: 2020-03-16
Description: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168862; https://www.ibm.com/support/pages/node/1135101; https://exchange.xforce.ibmcloud.com/vulnerabilities/168862
CVE: CVE-2019-4656
Published: 2020-03-16
Description: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due to an error processing error messages. IBM X-Force ID: 170967.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170967; https://www.ibm.com/support/pages/node/1135095; https://exchange.xforce.ibmcloud.com/vulnerabilities/170967
CVE: CVE-2019-4719
Published: 2020-03-16
Description: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172124; https://www.ibm.com/support/pages/node/1136608; https://exchange.xforce.ibmcloud.com/vulnerabilities/172124
CVE: CVE-2020-10230
Published: 2020-03-16
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://centos-webpanel.com/changelog-cwp7; https://www.exploit-db.com/exploits/48212; https://centos-webpanel.com/changelog-cwp7
CVE: CVE-2020-10238
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-incorrect-access-control-in-com-templates; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-incorrect-access-control-in-com-templates
CVE: CVE-2020-10239
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-incorrect-access-control-in-com-fields-sql-field; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-incorrect-access-control-in-com-fields-sql-field
CVE: CVE-2020-10240
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-identifier-collisions-in-com-users; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-identifier-collisions-in-com-users
CVE: CVE-2020-10241
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-templates-image-actions; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-csrf-in-com-templates-image-actions
CVE: CVE-2020-10242
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-xss-in-protostar-and-beez3; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-xss-in-protostar-and-beez3
CVE: CVE-2020-10243
Published: 2020-03-16
Description: An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featured Articles frontend menutype.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-sql-injection-in-featured-articles-menu-parameters; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-sql-injection-in-featured-articles-menu-parameters
CVE: CVE-2020-1735
Published: 2020-03-16
Description: A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735; https://github.com/ansible/ansible/issues/67793; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/
CVE: CVE-2020-1736
Published: 2020-03-16
Description: A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS Score: 2.2 (LOW)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736; https://github.com/ansible/ansible/issues/67794; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/
CVE: CVE-2020-1738
Published: 2020-03-16
Description: A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS Score: 3.9 (LOW)
CWE: CWE-88, CWE-88
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738; https://github.com/ansible/ansible/issues/67796; https://security.gentoo.org/glsa/202006-11
CVE: CVE-2020-1740
Published: 2020-03-16
Description: A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS Score: 3.9 (LOW)
CWE: CWE-377, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740; https://github.com/ansible/ansible/issues/67798; https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html
CVE: CVE-2020-6584
Published: 2020-03-16
Description: Nagios Log Server 2.1.3 has Incorrect Access Control.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT; https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60; https://www.nagios.com/products/nagios-log-server/
CVE: CVE-2020-6585
Published: 2020-03-16
Description: Nagios Log Server 2.1.3 has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT; https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60; https://www.nagios.com/products/nagios-log-server/
CVE: CVE-2020-6586
Published: 2020-03-16
Description: Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT; https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60; https://www.nagios.com/products/nagios-log-server/
CVE: CVE-2020-6980
Published: 2020-03-16
Description: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol (SMTP) account data is saved in RSLogix 500, a local attacker with access to a victim’s project may be able to gather SMTP server authentication data as it is written to the project file in cleartext.
CVSS Score: 3.3 (LOW)
CWE: CWE-312, CWE-312
References: https://www.us-cert.gov/ics/advisories/icsa-20-070-06; https://www.us-cert.gov/ics/advisories/icsa-20-070-06
CVE: CVE-2020-6984
Published: 2020-03-16
Description: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.us-cert.gov/ics/advisories/icsa-20-070-06; https://www.us-cert.gov/ics/advisories/icsa-20-070-06
CVE: CVE-2020-6988
Published: 2020-03-16
Description: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix 500 software to the victim’s MicroLogix controller. The controller will then respond to the client with used password values to authenticate the user on the client-side. This method of authentication may allow an attacker to bypass authentication altogether, disclose sensitive information, or leak credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-603, CWE-287
References: https://www.us-cert.gov/ics/advisories/icsa-20-070-06; https://www.us-cert.gov/ics/advisories/icsa-20-070-06
CVE: CVE-2020-6990
Published: 2020-03-16
Description: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-20-070-06; https://www.us-cert.gov/ics/advisories/icsa-20-070-06
CVE: CVE-2019-19821
Published: 2020-03-16
Description: A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796; https://www.combodo.com/itop-193; https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/
CVE: CVE-2019-19945
Published: 2020-03-16
Description: uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "Transfer-Encoding: chunked" and a large negative Content-Length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-681
References: https://github.com/openwrt/openwrt/commits/master; https://openwrt.org/advisory/2020-01-13-1; https://github.com/openwrt/openwrt/commits/master
CVE: CVE-2019-19946
Published: 2020-03-16
Description: The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/dradis-pro-3-4-1; https://know.bishopfox.com/advisories
CVE: CVE-2019-5543
Published: 2020-03-16
Description: For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.vmware.com/security/advisories/VMSA-2020-0004.html; https://www.vmware.com/security/advisories/VMSA-2020-0004.html
CVE: CVE-2020-3947
Published: 2020-03-16
Description: VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition of the vmnetdhcp service running on the host machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.vmware.com/security/advisories/VMSA-2020-0004.html; https://www.vmware.com/security/advisories/VMSA-2020-0004.html
CVE: CVE-2020-3948
Published: 2020-03-16
Description: Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to improper file permissions in Cortado Thinprint. Local attackers with non-administrative access to a Linux guest VM with virtual printing enabled may exploit this issue to elevate their privileges to root on the same guest VM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.vmware.com/security/advisories/VMSA-2020-0004.html; https://www.vmware.com/security/advisories/VMSA-2020-0004.html
CVE: CVE-2020-5844
Published: 2020-03-16
Description: index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html; https://github.com/TheCyberGeek/CVE-2020-5844; https://pandorafms.com
CVE: CVE-2020-5847
Published: 2020-03-16
Description: Unraid through 6.8.0 allows Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html; https://forums.unraid.net/forum/7-announcements/; https://sysdream.com/news/lab/
CVE: CVE-2020-5849
Published: 2020-03-16
Description: Unraid 6.8.0 allows authentication bypass.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697, CWE-697
References: http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html; https://forums.unraid.net/forum/7-announcements/; https://sysdream.com/news/lab/
CVE: CVE-2020-6581
Published: 2020-03-16
Description: Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
CVSS Score: 7.3 (HIGH)
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0002/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DNGKXVDB43E3KQRA6W5QZT3Z46XZLQM/
CVE: CVE-2020-6582
Published: 2020-03-16
Description: Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681, CWE-787
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0001/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DNGKXVDB43E3KQRA6W5QZT3Z46XZLQM/
CVE: CVE-2020-7916
Published: 2020-03-16
Description: be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://wordpress.org/plugins/learnpress/#developers; https://wordpress.org/plugins/learnpress/#developers
CVE: CVE-2018-19325
Published: 2020-03-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14466. Reason: This candidate is a duplicate of CVE-2018-14466. Notes: All CVE users should reference CVE-2018-14466 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-11073
Published: 2020-03-16
Description: A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization when passing arguments to the HttpTransactionSensor.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Transaction Sensor and set specific settings when the sensor is executed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://sensepost.com/blog/2019/being-stubborn-pays-off-pt.-1-cve-2018-19204/; https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/11/warnmeldung_cb-k19-1019.html; https://www.paessler.com/prtg/history/stable
CVE: CVE-2020-9321
Published: 2020-03-16
Description: configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/containous/traefik/pull/6281; https://github.com/containous/traefik/releases/tag/v2.1.4; https://github.com/containous/traefik/pull/6281
CVE: CVE-2017-12842
Published: 2020-03-16
Description: Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did not actually occur. Completing the attack would cost more than a million dollars, and is relevant mainly only in situations where an autonomous system relies solely on an SPV proof for transactions of a greater dollar amount.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bitslog.wordpress.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design/; https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures; https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-February/016697.html
CVE: CVE-2019-18917
Published: 2020-03-16
Description: A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://support.hp.com/us-en/document/c06594863; https://support.hp.com/us-en/document/c06594863
CVE: CVE-2019-19212
Published: 2020-03-16
Description: Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://herolab.usd.de/en/security-advisories/; https://herolab.usd.de/security-advisories/usd-2019-0054/; https://www.dolibarr.org/forum/dolibarr-changelogs
CVE: CVE-2019-19461
Published: 2020-03-16
Description: Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://teampasswordmanager.com/docs/changelog/; https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/; https://teampasswordmanager.com/docs/changelog/