deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-3988
Published: 2018-12-10
Description: Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106207; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0656; http://www.securityfocus.com/bid/106207
CVE: CVE-2018-1279
Published: 2018-12-10
Description: Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.
CVSS Score: 8.5 (HIGH)
CWE: CWE-330
References: https://pivotal.io/security/cve-2018-1279; https://pivotal.io/security/cve-2018-1279
CVE: CVE-2018-15800
Published: 2018-12-10
Description: Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://www.cloudfoundry.org/blog/cve-2018-15800; https://www.cloudfoundry.org/blog/cve-2018-15800
CVE: CVE-2018-15805
Published: 2018-12-10
Description: Accusoft PrizmDoc HTML5 Document Viewer before 13.5 contains an XML external entity (XXE) vulnerability, allowing an attacker to read arbitrary files or cause a denial of service (resource consumption).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://help.accusoft.com/PrizmDoc/v13.5/HTML/webframe.html#Release_v13_5.html; https://medium.com/%40mrnikhilsri/oob-xxe-in-prizmdoc-cve-2018-15805-dfb1e474345c; https://help.accusoft.com/PrizmDoc/v13.5/HTML/webframe.html#Release_v13_5.html
CVE: CVE-2018-16635
Published: 2018-12-10
Description: Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/security-breachlock/CVE-2018-16635/blob/master/blackcatcms.pdf; https://github.com/security-breachlock/CVE-2018-16635/blob/master/blackcatcms.pdf
CVE: CVE-2018-16636
Published: 2018-12-10
Description: Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/NucleusCMS/NucleusCMS/issues/84; https://github.com/security-breachlock/CVE-2018-16636/blob/master/nucleus_html.pdf; https://github.com/NucleusCMS/NucleusCMS/issues/84
CVE: CVE-2018-20029
Published: 2018-12-10
Description: The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://www.nomachine.com/TR11P08975; https://www.nomachine.com/TR11P08975
CVE: CVE-2018-15757
Published: 2018-12-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2018-20050
Published: 2018-12-10
Description: Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method.
CVSS Score: 7.5 (HIGH)
References: https://github.com/iamweifan/jooan/blob/master/es_poc.py; https://github.com/iamweifan/jooan/blob/master/es_poc.py
CVE: CVE-2018-20051
Published: 2018-12-10
Description: Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/iamweifan/jooan/blob/master/ss_poc.py; https://github.com/iamweifan/jooan/blob/master/ss_poc.py
CVE: CVE-2018-20056
Published: 2018-12-11
Description: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20stack%20overflow.md; https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20stack%20overflow.md
CVE: CVE-2018-20057
Published: 2018-12-11
Description: An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20command%20execution.md; https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/DIR-619%20command%20execution.md
CVE: CVE-2018-20058
Published: 2018-12-11
Description: In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://evernote.com/security/updates; https://evernote.com/security/updates
CVE: CVE-2018-20059
Published: 2018-12-11
Description: jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/pippo-java/pippo/issues/486; https://github.com/pippo-java/pippo/issues/486
CVE: CVE-2018-1652
Published: 2018-12-11
Description: IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of service through unknown vectors. IBM X-Force ID: 144724.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/144724; https://www.ibm.com/support/docview.wss?uid=ibm10717483; https://www.ibm.com/support/docview.wss?uid=ibm10744557
CVE: CVE-2018-1654
Published: 2018-12-11
Description: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 144747.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: http://www.securityfocus.com/bid/106187; https://exchange.xforce.ibmcloud.com/vulnerabilities/144747; https://www.ibm.com/support/docview.wss?uid=ibm10739027
CVE: CVE-2018-17480
Published: 2018-12-11
Description: Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-17481
Published: 2018-12-11
Description: Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18335
Published: 2018-12-11
Description: Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html; http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803
CVE: CVE-2018-18336
Published: 2018-12-11
Description: Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18337
Published: 2018-12-11
Description: Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18338
Published: 2018-12-11
Description: Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18339
Published: 2018-12-11
Description: Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18340
Published: 2018-12-11
Description: Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18341
Published: 2018-12-11
Description: An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18342
Published: 2018-12-11
Description: Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18343
Published: 2018-12-11
Description: Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18344
Published: 2018-12-11
Description: Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18345
Published: 2018-12-11
Description: Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18346
Published: 2018-12-11
Description: Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18347
Published: 2018-12-11
Description: Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into executing javascript in an arbitrary origin via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18348
Published: 2018-12-11
Description: Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18349
Published: 2018-12-11
Description: Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18350
Published: 2018-12-11
Description: Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18351
Published: 2018-12-11
Description: Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18352
Published: 2018-12-11
Description: Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18353
Published: 2018-12-11
Description: Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18354
Published: 2018-12-11
Description: Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external programs via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18355
Published: 2018-12-11
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18356
Published: 2018-12-11
Description: An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00043.html; http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803
CVE: CVE-2018-18357
Published: 2018-12-11
Description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18358
Published: 2018-12-11
Description: Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-18359
Published: 2018-12-11
Description: Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106084; https://access.redhat.com/errata/RHSA-2018:3803; https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
CVE: CVE-2018-1900
Published: 2018-12-11
Description: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106189; https://exchange.xforce.ibmcloud.com/vulnerabilities/152529; https://www.ibm.com/support/docview.wss?uid=ibm10739035
CVE: CVE-2018-1904
Published: 2018-12-11
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: http://www.securityfocus.com/bid/106193; https://exchange.xforce.ibmcloud.com/vulnerabilities/152533; https://www-01.ibm.com/support/docview.wss?uid=ibm10738735
CVE: CVE-2018-19968
Published: 2018-12-11
Description: An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106178; https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html; https://security.gentoo.org/glsa/201904-16
CVE: CVE-2018-19969
Published: 2018-12-11
Description: phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/106175; https://security.gentoo.org/glsa/201904-16; https://www.phpmyadmin.net/security/PMASA-2018-7/
CVE: CVE-2018-19970
Published: 2018-12-11
Description: In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106181; https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html; https://security.gentoo.org/glsa/201904-16
CVE: CVE-2018-20060
Published: 2018-12-11
Description: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html; https://access.redhat.com/errata/RHSA-2019:2272; https://bugzilla.redhat.com/show_bug.cgi?id=1649153