deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6650
Published: 2019-09-20
Description: F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVSS Score: 9.1 (CRITICAL)
References: https://support.f5.com/csp/article/K04280042; https://support.f5.com/csp/article/K04280042?utm_source=f5support&amp%3Butm_medium=RSS; https://support.f5.com/csp/article/K04280042
CVE: CVE-2019-16649
Published: 2019-09-21
Description: On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-326, CWE-522
References: https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/; https://github.com/eclypsium/USBAnywhere; https://www.supermicro.com/support/security_BMC_virtual_media.cfm
CVE: CVE-2019-16650
Published: 2019-09-21
Description: On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
CVSS Score: 10.0 (CRITICAL)
References: https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/; https://github.com/eclypsium/USBAnywhere; https://www.supermicro.com/support/security_BMC_virtual_media.cfm
CVE: CVE-2019-16655
Published: 2019-09-21
Description: joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.
CVSS Score: 7.5 (HIGH)
References: https://github.com/joyplus/joyplus-cms/issues/441; https://github.com/joyplus/joyplus-cms/issues/441
CVE: CVE-2019-16656
Published: 2019-09-21
Description: joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/joyplus/joyplus-cms/issues/442; https://github.com/joyplus/joyplus-cms/issues/442
CVE: CVE-2019-16657
Published: 2019-09-21
Description: TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/yeyinshi/tuzicms/issues/5; https://github.com/yeyinshi/tuzicms/issues/5
CVE: CVE-2019-16658
Published: 2019-09-21
Description: TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yeyinshi/tuzicms/issues/4; https://github.com/yeyinshi/tuzicms/issues/4
CVE: CVE-2019-16659
Published: 2019-09-21
Description: TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/yeyinshi/tuzicms/issues/3; https://github.com/yeyinshi/tuzicms/issues/3
CVE: CVE-2019-16660
Published: 2019-09-21
Description: joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/joyplus/joyplus-cms/issues/440; https://github.com/joyplus/joyplus-cms/issues/440
CVE: CVE-2019-16661
Published: 2019-09-21
Description: Ogma CMS 0.5 has XSS via creation of a new blog.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/n00dles/ogma-CMS/issues/42; https://github.com/n00dles/ogma-CMS/issues/42
CVE: CVE-2019-16664
Published: 2019-09-21
Description: An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinksaas/ThinkSAAS/issues/20; https://github.com/thinksaas/ThinkSAAS/issues/20
CVE: CVE-2019-16665
Published: 2019-09-21
Description: An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thinksaas/ThinkSAAS/issues/21; https://github.com/thinksaas/ThinkSAAS/issues/21
CVE: CVE-2019-16669
Published: 2019-09-21
Description: The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/pagekit/pagekit/issues/935; https://github.com/pagekit/pagekit/issues/935
CVE: CVE-2019-16677
Published: 2019-09-21
Description: An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/idreamsoft/iCMS/issues/76; https://github.com/idreamsoft/iCMS/issues/76
CVE: CVE-2019-16678
Published: 2019-09-21
Description: admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/yzmcms/yzmcms/issues/27; https://github.com/yzmcms/yzmcms/issues/27
CVE: CVE-2019-16679
Published: 2019-09-21
Description: Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/154578/Gila-CMS-Local-File-Inclusion.html; https://github.com/GilaCMS/gila/issues/33; https://github.com/GilaCMS/gila/releases/tag/1.11.1
CVE: CVE-2019-16680
Published: 2019-09-21
Description: An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://bugzilla.gnome.org/show_bug.cgi?id=794337; https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2; https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1
CVE: CVE-2019-16681
Published: 2019-09-21
Description: The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can inject deceptive content into the UI. (When in physical possession of the device, opening local files is also possible.) NOTE: As of 2019-09-23, the vendor has not agreed that this issue has serious impact. The vendor states that the issue is not critical because it does not allow Elevation of Privilege, Sensitive Data Leakage, or any critical unauthorized activity from a malicious user. The vendor also states that a victim must first install a malicious APK to their application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability; https://web.archive.org/web/[PII_REDACTED]5849/https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability; https://github.com/tarantula-team/Traveloka-Android-App-Critical-Vulnerability
CVE: CVE-2018-21018
Published: 2019-09-22
Description: Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://github.com/tootsuite/mastodon/pull/9329; https://github.com/tootsuite/mastodon/pull/9381; https://github.com/tootsuite/mastodon/releases/tag/v2.6.2
CVE: CVE-2019-16692
Published: 2019-09-22
Description: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/154651/phpIPAM-1.4-SQL-Injection.html; https://github.com/phpipam/phpipam/issues/2738; http://packetstormsecurity.com/files/154651/phpIPAM-1.4-SQL-Injection.html
CVE: CVE-2019-16693
Published: 2019-09-22
Description: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2019-16693.md; https://github.com/phpipam/phpipam/issues/2738; https://github.com/phpipam/phpipam/issues/2738
CVE: CVE-2019-16694
Published: 2019-09-22
Description: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/phpipam/phpipam/issues/2738; https://github.com/phpipam/phpipam/issues/2738
CVE: CVE-2019-16695
Published: 2019-09-22
Description: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/phpipam/phpipam/issues/2738; https://github.com/phpipam/phpipam/issues/2738
CVE: CVE-2019-16696
Published: 2019-09-22
Description: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/phpipam/phpipam/issues/2738; https://github.com/phpipam/phpipam/issues/2738
CVE: CVE-2019-16702
Published: 2019-09-23
Description: Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://packetstormsecurity.com/files/155578/Integard-Pro-NoJs-2.2.0.9026-Remote-Buffer-Overflow.html; https://github.com/purpl3-f0x/exploit-dev/blob/master/nojs_integard.py; http://packetstormsecurity.com/files/155578/Integard-Pro-NoJs-2.2.0.9026-Remote-Buffer-Overflow.html
CVE: CVE-2019-16703
Published: 2019-09-23
Description: admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gaozhifeng/PHPMyWind/issues/7; https://github.com/gaozhifeng/PHPMyWind/issues/7
CVE: CVE-2019-16704
Published: 2019-09-23
Description: admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/lolipop1234/XXD/issues/1; https://github.com/lolipop1234/XXD/issues/1
CVE: CVE-2019-16705
Published: 2019-09-23
Description: Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/libming/libming/issues/178; https://github.com/libming/libming/issues/178
CVE: CVE-2019-16706
Published: 2019-09-23
Description: kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/wangyifani/kkcms/issues/1; https://github.com/wangyifani/kkcms/issues/1
CVE: CVE-2019-16691
Published: 2019-09-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-16707
Published: 2019-09-23
Description: Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/butterflyhack/hunspell-crash; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24NTBHK2QNYKSBMJI34WEU5MHS3H2FAI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2YOYFI36IWKABNGFTWXCH7TTGAFODH6/
CVE: CVE-2019-16708
Published: 2019-09-23
Description: ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1531
CVE: CVE-2019-16709
Published: 2019-09-23
Description: ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html
CVE: CVE-2019-16710
Published: 2019-09-23
Description: ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1528
CVE: CVE-2019-16711
Published: 2019-09-23
Description: ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1542
CVE: CVE-2019-16712
Published: 2019-09-23
Description: ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1557
CVE: CVE-2019-16713
Published: 2019-09-23
Description: ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1558
CVE: CVE-2019-16714
Published: 2019-09-23
Description: In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: http://www.openwall.com/lists/oss-security/2019/09/24/2; http://www.openwall.com/lists/oss-security/2019/09/25/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.14
CVE: CVE-2019-16718
Published: 2019-09-23
Description: In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/radareorg/radare2/commit/5411543a310a470b1257fb93273cdd6e8dfcb3af; https://github.com/radareorg/radare2/commit/dd739f5a45b3af3d1f65f00fe19af1dbfec7aea7; https://github.com/radareorg/radare2/compare/3.8.0...3.9.0
CVE: CVE-2019-16719
Published: 2019-09-23
Description: WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-352
References: http://www.iwantacve.cn/index.php/archives/344/; http://www.iwantacve.cn/index.php/archives/344/
CVE: CVE-2019-16720
Published: 2019-09-23
Description: ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://www.iwantacve.cn/index.php/archives/333/; http://www.iwantacve.cn/index.php/archives/333/
CVE: CVE-2019-16721
Published: 2019-09-23
Description: NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.iwantacve.cn/index.php/archives/337/; http://www.iwantacve.cn/index.php/archives/337/
CVE: CVE-2019-16722
Published: 2019-09-23
Description: ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
CVSS Score: 9.8 (CRITICAL)
References: http://www.iwantacve.cn/index.php/archives/348/; http://www.iwantacve.cn/index.php/archives/348/
CVE: CVE-2019-3416
Published: 2019-09-23
Description: All versions up to V8[PII_REDACTED] of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can take advantage of this vulnerability to control the user terminal system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011263; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011263
CVE: CVE-2019-10087
Published: 2019-09-23
Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087
CVE: CVE-2019-10089
Published: 2019-09-23
Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089
CVE: CVE-2019-12404
Published: 2019-09-23
Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12404; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12404
CVE: CVE-2019-13063
Published: 2019-09-23
Description: Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://sahipro.com/downloads-archive/; https://www.exploit-db.com/exploits/47062; https://sahipro.com/downloads-archive/
CVE: CVE-2019-16518
Published: 2019-09-23
Description: An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger an unintended temperature in the victim's mouth and throat via Bluetooth Low Energy (BLE) packets that specify large power or voltage values.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668
References: https://gitlab.com/crypt0crc/cve-2019-16518; https://gitlab.com/crypt0crc/cve-2019-16518
CVE: CVE-2019-16723
Published: 2019-09-23
Description: In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2018-21019
Published: 2019-09-23
Description: Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/home-assistant/home-assistant/pull/13836; https://github.com/home-assistant/home-assistant/releases/tag/0.67.0; https://github.com/home-assistant/home-assistant/pull/13836
CVE: CVE-2019-10090
Published: 2019-09-23
Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090
CVE: CVE-2019-10978
Published: 2019-09-23
Description: Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.us-cert.gov/ics/advisories/icsa-19-248-01; https://www.us-cert.gov/ics/advisories/icsa-19-248-01
CVE: CVE-2019-10984
Published: 2019-09-23
Description: Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-465
References: https://www.us-cert.gov/ics/advisories/icsa-19-248-01; https://www.us-cert.gov/ics/advisories/icsa-19-248-01
CVE: CVE-2019-10990
Published: 2019-09-23
Description: Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-19-248-01; https://www.us-cert.gov/ics/advisories/icsa-19-248-01
CVE: CVE-2019-10996
Published: 2019-09-23
Description: Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that can reference memory after it has been freed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.us-cert.gov/ics/advisories/icsa-19-248-01; https://www.us-cert.gov/ics/advisories/icsa-19-248-01
CVE: CVE-2019-12407
Published: 2019-09-23
Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407; https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407
CVE: CVE-2019-16377
Published: 2019-09-23
Description: The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/makandra/consul/issues/49; https://rubygems.org/gems/consul; https://github.com/makandra/consul/issues/49