deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8804
Published: 2020-02-13
Description: SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/156331/SuiteCRM-7.11.10-SQL-Injection.html; http://seclists.org/fulldisclosure/2020/Feb/7; https://suitecrm.com
CVE: CVE-2012-1500
Published: 2020-02-13
Description: Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]5829/http://www.cloudscan.me/2012/09/cve-2012-1500-ghs-5375-ghs-5642.html; https://www.exploit-db.com/exploits/21052; https://web.archive.org/web/[PII_REDACTED]5829/http://www.cloudscan.me/2012/09/cve-2012-1500-ghs-5375-ghs-5642.html
CVE: CVE-2012-1903
Published: 2020-02-13
Description: XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]2930/http://www.cloudscan.me/2013/03/cve-2012-1903-stored-xss-javascript.html; https://web.archive.org/web/[PII_REDACTED]2930/http://www.cloudscan.me/2013/03/cve-2012-1903-stored-xss-javascript.html
CVE: CVE-2019-10785
Published: 2020-02-13
Description: dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr; https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html; https://snyk.io/vuln/SNYK-JS-DOJOX-548257%2C
CVE: CVE-2020-0560
Published: 2020-02-13
Description: Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00273.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00273.html
CVE: CVE-2020-8981
Published: 2020-02-13
Description: A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0; https://github.com/mantisbt-plugins/source-integration/issues/338; https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0
CVE: CVE-2012-5623
Published: 2020-02-13
Description: Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: http://www.openwall.com/lists/oss-security/2012/12/04/6; http://www.openwall.com/lists/oss-security/2012/12/04/6
CVE: CVE-2014-3919
Published: 2020-02-13
Description: A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: http://softage.be/netgear/; http://softage.be/netgear/
CVE: CVE-2014-4170
Published: 2020-02-13
Description: A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/127701/Free-Reprintables-ArticleFR-11.06.2014-Improper-Access-Control.html; http://www.exploit-db.com/exploits/34245; https://exchange.xforce.ibmcloud.com/vulnerabilities/95051
CVE: CVE-2014-4198
Published: 2020-02-13
Description: A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt; https://www3.trustwave.com/spiderlabs/advisories/TWSL2014-009.txt
CVE: CVE-2019-14598
Published: 2020-02-13
Description: Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-287
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00307.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-0561
Published: 2020-02-13
Description: Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00014.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00336.html
CVE: CVE-2020-0562
Published: 2020-02-13
Description: Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00339.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00339.html
CVE: CVE-2020-0563
Published: 2020-02-13
Description: Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00340.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00340.html
CVE: CVE-2020-0564
Published: 2020-02-13
Description: Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00341.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00341.html
CVE: CVE-2012-6091
Published: 2020-02-13
Description: Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2013/01/03/10; http://www.securityfocus.com/bid/57140; https://exchange.xforce.ibmcloud.com/vulnerabilities/80973
CVE: CVE-2013-0295
Published: 2020-02-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0342. Reason: This candidate is a duplicate of [ID]. Notes: All CVE users should reference CVE-2013-0342 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-3208
Published: 2020-02-13
Description: A Denial of Service vulnerability exists in askpop3d 0.7.7 in free (pszQuery),
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2014/05/05/3; https://www.securityfocus.com/bid/67219; http://www.openwall.com/lists/oss-security/2014/05/05/3
CVE: CVE-2015-3309
Published: 2020-02-13
Description: Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://cve.killedkenny.io/cve/CVE-2015-3309; http://www.openwall.com/lists/oss-security/2015/04/16/8; https://github.com/ether/etherpad-lite/commit/0fa7650df8f940ed6b577d79836a78eb09726c4b
CVE: CVE-2013-1400
Published: 2020-02-13
Description: Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/57479; https://exchange.xforce.ibmcloud.com/vulnerabilities/81466; https://www.securityfocus.com/archive/1/525370
CVE: CVE-2013-1401
Published: 2020-02-13
Description: Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/57479; https://exchange.xforce.ibmcloud.com/vulnerabilities/81467; https://www.securityfocus.com/archive/1/525370
CVE: CVE-2015-6589
Published: 2020-02-13
Description: Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html; http://www.zerodayinitiative.com/advisories/ZDI-15-450; https://www.exploit-db.com/exploits/38351/
CVE: CVE-2019-3998
Published: 2020-02-13
Description: Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network the base station connects to.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://www.tenable.com/security/research/tra-2020-09; https://www.tenable.com/security/research/tra-2020-09
CVE: CVE-2020-8988
Published: 2020-02-13
Description: The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a copy of the local database) to discover login credentials and voting history via an offline brute-force approach.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-330, CWE-521
References: https://blog.voatz.com/?p=1209; https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf; https://blog.voatz.com/?p=1209
CVE: CVE-2020-8989
Published: 2020-02-13
Description: In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example, a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://blog.voatz.com/?p=1209; https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf; https://blog.voatz.com/?p=1209
CVE: CVE-2013-1634
Published: 2020-02-13
Description: A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex, 33 hex, or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: http://blog.krisk.org/2013/02/packets-of-death.html; http://web.archive.org/web/[PII_REDACTED]5429/https://communities.intel.com/community/wired/blog/2013/02/07/intel-82574l-gigabit-ethernet-controller-statement; http://www.openwall.com/lists/oss-security/2013/02/12/3
CVE: CVE-2014-1617
Published: 2020-02-13
Description: Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: http://fortiguardcenter.com/encyclopedia/ips/38068; https://packetstormsecurity.com/files/cve/CVE-2014-1617; http://fortiguardcenter.com/encyclopedia/ips/38068
CVE: CVE-2013-6277
Published: 2020-02-13
Description: QNAP VioCard 300 has hardcoded RSA private keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://firmware.re/usenixsec14/; http://firmware.re/vulns/acsa-2013-002.php; http://firmware.re/usenixsec14/
CVE: CVE-2013-6360
Published: 2020-02-13
Description: TRENDnet TS-S402 has a backdoor to enable TELNET.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://firmware.re/usenixsec14/; http://firmware.re/vulns/acsa-2013-014.php; http://firmware.re/usenixsec14/
CVE: CVE-2013-6362
Published: 2020-02-13
Description: Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://firmware.re/usenixsec14/; http://firmware.re/vulns/acsa-2013-005.php; http://firmware.re/usenixsec14/
CVE: CVE-2013-6927
Published: 2020-02-13
Description: Internet TRiLOGI Server (unknown versions) could allow a local user to bypass security and create a local user account.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/64192; https://exchange.xforce.ibmcloud.com/vulnerabilities/90077; http://www.securityfocus.com/bid/64192
CVE: CVE-2013-7098
Published: 2020-02-13
Description: OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.infradead.org/openconnect/changelog.html; http://www.infradead.org/openconnect/changelog.html
CVE: CVE-2013-7173
Published: 2020-02-13
Description: Belkin n750 routers have a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://pixels.camp/marcovazpt; https://www.youtube.com/watch?v=RG1k8S3VHnQ; https://pixels.camp/marcovazpt
CVE: CVE-2013-7287
Published: 2020-02-13
Description: MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: http://seclists.org/fulldisclosure/2014/Apr/21; https://www.securityfocus.com/archive/1/531713; http://seclists.org/fulldisclosure/2014/Apr/21
CVE: CVE-2013-4791
Published: 2020-02-14
Description: PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html; http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html
CVE: CVE-2013-4792
Published: 2020-02-14
Description: PrestaShop before 1.4.11 allows logout CSRF.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352
References: http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html; http://davidsopaslabs.blogspot.com/2013/07/prestashop-persistent-xss-and-csrf.html
CVE: CVE-2013-5212
Published: 2020-02-14
Description: Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2013/Oct/224; https://exchange.xforce.ibmcloud.com/vulnerabilities/88293; http://seclists.org/fulldisclosure/2013/Oct/224
CVE: CVE-2013-5687
Published: 2020-02-14
Description: RiskNet Acquirer before hotfix 6.0 b7+ADHOC-443 ApplicationServiceBean contains a service information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89118; https://exchange.xforce.ibmcloud.com/vulnerabilities/89118
CVE: CVE-2020-8991
Published: 2020-02-14
Description: vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug
CVSS Score: 2.3 (LOW)
CWE: CWE-401
References: https://sourceware.org/git/?p=lvm2.git%3Ba=commit%3Bh=bcf9556b8fcd16ad8997f80cc92785f295c66701; https://sourceware.org/git/?p=lvm2.git%3Ba=commit%3Bh=bcf9556b8fcd16ad8997f80cc92785f295c66701
CVE: CVE-2020-8992
Published: 2020-02-14
Description: ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-834
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://patchwork.ozlabs.org/patch/1236118/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-20454
Published: 2020-02-14
Description: An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.exim.org/show_bug.cgi?id=2421; https://bugs.php.net/bug.php?id=78338; https://bugzilla.redhat.com/show_bug.cgi?id=1735494
CVE: CVE-2020-5532
Published: 2020-02-14
Description: ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN35496038/index.html; https://apps.apple.com/us/app/ilbo/id[PII_REDACTED]; https://play.google.com/store/apps/details?id=jp.extrun.ilbo&hl=en
CVE: CVE-2020-7251
Published: 2020-02-14
Description: Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-358, CWE-863
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10299; https://kc.mcafee.com/corporate/index?page=content&id=SB10299
CVE: CVE-2018-21032
Published: 2020-02-14
Description: A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/; https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/
CVE: CVE-2018-21033
Published: 2020-02-14
Description: A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/; https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-128/; http://www.hitachi.co.jp/Prod/comp/soft1/global/security/
CVE: CVE-2019-20455
Published: 2020-02-14
Description: Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/globalpayments/php-sdk/compare/1.3.3...2.0.0; https://github.com/globalpayments/php-sdk/pull/8; https://github.com/globalpayments/php-sdk/releases/tag/2.0.0
CVE: CVE-2019-19757
Published: 2020-02-14
Description: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.lenovo.com/us/en/product_security/LEN-29477; https://support.lenovo.com/us/en/product_security/LEN-29477
CVE: CVE-2019-19758
Published: 2020-02-14
Description: A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://support.lenovo.com/us/en/product_security/LEN-30242; https://support.lenovo.com/us/en/product_security/LEN-30242
CVE: CVE-2019-19762
Published: 2020-02-14
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-19763
Published: 2020-02-14
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-19764
Published: 2020-02-14
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-19765
Published: 2020-02-14
Description: Rejected reason: Unused CVE for 2019
CVE: CVE-2019-19879
Published: 2020-02-14
Description: HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.
CVSS Score: 7.5 (HIGH)
References: https://discuss.hashicorp.com/t/security-bulletin-sentinel-incorrectly-parses-negation-in-certain-policy-expressions/5955; https://discuss.hashicorp.com/t/security-bulletin-sentinel-incorrectly-parses-negation-in-certain-policy-expressions/5955
CVE: CVE-2019-20045
Published: 2020-02-14
Description: The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets could cause disconnection of active authentic connections or reboot of device. This is a different issue than CVE-2019-16879 and CVE-2019-20046.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.us-cert.gov/ics/advisories/icsa-20-042-01; https://www.us-cert.gov/ics/advisories/icsa-20-042-01
CVE: CVE-2019-20046
Published: 2020-02-14
Description: The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate authentication, which may allow an attacker to read sensitive information or execute arbitrary code. This is a different issue than CVE-2019-16879 and CVE-2019-20045.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.us-cert.gov/ics/advisories/icsa-20-042-01; https://www.us-cert.gov/ics/advisories/icsa-20-042-01