deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11939
Published: 2020-03-18
Description: Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757; https://www.facebook.com/security/advisories/cve-2019-11939; https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757
CVE: CVE-2019-20510
Published: 2020-03-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-13456. Reason: This candidate is a duplicate of CVE-2019-13456. Notes: All CVE users should reference CVE-2019-13456 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-8467
Published: 2020-03-18
Description: A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
CVSS Score: 8.8 (HIGH)
References: https://success.trendmicro.com/jp/solution/000244253; https://success.trendmicro.com/solution/000245571; https://success.trendmicro.com/jp/solution/000244253
CVE: CVE-2020-8468
Published: 2020-03-18
Description: Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://success.trendmicro.com/jp/solution/000244253; https://success.trendmicro.com/jp/solution/000244836; https://success.trendmicro.com/solution/000245571
CVE: CVE-2020-8470
Published: 2020-03-18
Description: Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://success.trendmicro.com/jp/solution/000244253; https://success.trendmicro.com/jp/solution/000244836; https://success.trendmicro.com/solution/000245571
CVE: CVE-2020-8598
Published: 2020-03-18
Description: Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a remote attacker to execute arbitrary code on affected installations with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://success.trendmicro.com/jp/solution/000244253; https://success.trendmicro.com/jp/solution/000244836; https://success.trendmicro.com/solution/000245571
CVE: CVE-2020-8599
Published: 2020-03-18
Description: Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://success.trendmicro.com/jp/solution/000244253; https://success.trendmicro.com/solution/000245571; https://success.trendmicro.com/jp/solution/000244253
CVE: CVE-2020-8600
Published: 2020-03-18
Description: Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key file to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://success.trendmicro.com/jp/solution/000244836; https://success.trendmicro.com/solution/000245572; https://www.zerodayinitiative.com/advisories/ZDI-20-307/
CVE: CVE-2020-10659
Published: 2020-03-18
Description: Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for example) a user continues to interact with a web site that has an invalid certificate chain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/etherpacket/CVD-Applications/blob/master/EDC%20Security%20Bulletin%20E19-001a.pdf; https://github.com/etherpacket/CVD-Applications/blob/master/eespwin_10_10060_readme.pdf; https://github.com/etherpacket/CVD-Applications/blob/master/EDC%20Security%20Bulletin%20E19-001a.pdf
CVE: CVE-2020-3922
Published: 2020-03-18
Description: LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/tonykuo76/50350af9b77eb51f5ab55964a35f47f2; https://www.chtsecurity.com/news/2fd99e6e-819f-42b4-a7fe-6bc7eeae155c; https://www.twcert.org.tw/tw/cp-132-3437-17241-1.html
CVE: CVE-2019-14881
Published: 2020-03-18
Description: A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14881; https://moodle.org/mod/forum/discuss.php?d=393584#p1586746; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14881
CVE: CVE-2019-14882
Published: 2020-03-18
Description: A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14882; https://moodle.org/mod/forum/discuss.php?d=393585#p1586747; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14882
CVE: CVE-2019-14883
Published: 2020-03-18
Description: A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14883; https://moodle.org/mod/forum/discuss.php?d=393586#p1586750; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14883
CVE: CVE-2019-14884
Published: 2020-03-18
Description: A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14884; https://moodle.org/mod/forum/discuss.php?d=393587#p1586751; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14884
CVE: CVE-2020-7002
Published: 2020-03-18
Description: Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be exploited when a valid user opens a specially crafted, malicious input file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-077-01; https://www.us-cert.gov/ics/advisories/icsa-20-077-01
CVE: CVE-2020-9443
Published: 2020-03-18
Description: Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2020/02/29/zulip-desktop-4-0-3-security-release/; https://blog.zulip.org/2020/02/29/zulip-desktop-4-0-3-security-release/
CVE: CVE-2020-4199
Published: 2020-03-18
Description: IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174910.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174910; https://www.ibm.com/support/pages/node/5968048; https://exchange.xforce.ibmcloud.com/vulnerabilities/174910
CVE: CVE-2020-6976
Published: 2020-03-18
Description: Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted, malicious input file due to the lack of validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-20-077-01; https://www.us-cert.gov/ics/advisories/icsa-20-077-01
CVE: CVE-2020-9323
Published: 2020-03-18
Description: Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.aquaforest.com/en/release_history.asp; https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/; https://www.criticalstart.com/resources/
CVE: CVE-2020-9324
Published: 2020-03-18
Description: Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.aquaforest.com/en/release_history.asp; https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/; https://www.criticalstart.com/resources/
CVE: CVE-2020-9325
Published: 2020-03-18
Description: Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-306
References: https://www.aquaforest.com/en/release_history.asp; https://www.criticalstart.com/multiple-vulnerabilities-discovered-in-tiff-server-from-aquaforest/; https://www.criticalstart.com/resources/
CVE: CVE-2019-10146
Published: 2020-03-18
Description: A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10146; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10146
CVE: CVE-2019-10682
Published: 2020-03-18
Description: django-nopassword before 5.0.0 stores cleartext secrets in the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://github.com/relekang/django-nopassword/blob/8e8cfc765ee00adfed120c2c79bf71ef856e9022/nopassword/models.py#L14; https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e[PII_REDACTED]93c; https://github.com/relekang/django-nopassword/compare/v4.0.1...v5.0.0
CVE: CVE-2019-11688
Published: 2020-03-18
Description: An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asustornasapi.asustor.com. In other words, there is Missing SSL Certificate Validation.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md; https://www.asustor.com/app_central/app_detail?id=776; https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md
CVE: CVE-2019-11689
Published: 2020-03-18
Description: An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md; https://www.asustor.com/app_central/app_detail?id=776; https://github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md
CVE: CVE-2020-9326
Published: 2020-03-18
Description: BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments with PowerShell .ps1 file extensions present, leading to a DefendpointService.exe crash.
CVSS Score: 7.5 (HIGH)
References: https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-5-sr1; https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-5-sr1
CVE: CVE-2019-10178
Published: 2020-03-18
Description: It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10178; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10178
CVE: CVE-2019-14871
Published: 2020-03-18
Description: The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions prior to 3.3.0, does not check for memory allocation problems when the DEBUG flag is unset (as is the case in production firmware builds).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/; https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
CVE: CVE-2019-19335
Published: 2020-03-18
Description: During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19335; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19335
CVE: CVE-2019-19351
Published: 2020-03-18
Description: An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/jenkins-slave-base-rhel7-containera as shipped in Openshift 4 and 3.11.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19351; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19351
CVE: CVE-2019-19355
Published: 2020-03-18
Description: An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19355; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19355
CVE: CVE-2019-12112
Published: 2020-03-18
Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jira.onap.org/browse/OJSI-199; https://jira.onap.org/browse/OJSI-199
CVE: CVE-2019-12113
Published: 2020-03-18
Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jira.onap.org/browse/OJSI-43; https://jira.onap.org/browse/OJSI-43
CVE: CVE-2019-12114
Published: 2020-03-18
Description: An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12115
Published: 2020-03-18
Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12116
Published: 2020-03-18
Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12117
Published: 2020-03-18
Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12118
Published: 2020-03-18
Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12119
Published: 2020-03-18
Description: An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12120
Published: 2020-03-18
Description: An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://jira.onap.org/browse/OJSI-10; https://jira.onap.org/browse/OJSI-10
CVE: CVE-2019-12121
Published: 2020-03-18
Description: An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://jira.onap.org/browse/OJSI-92; https://jira.onap.org/browse/OJSI-92
CVE: CVE-2019-12122
Published: 2020-03-18
Description: An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://jira.onap.org/browse/OJSI-65; https://jira.onap.org/browse/OJSI-65
CVE: CVE-2019-12123
Published: 2020-03-18
Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jira.onap.org/browse/OJSI-42; https://jira.onap.org/browse/OJSI-42
CVE: CVE-2019-12124
Published: 2020-03-18
Description: An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arbitrary file. All APPC setups are affected.
CVSS Score: 9.1 (CRITICAL)
References: https://jira.onap.org/browse/OJSI-63; https://jira.onap.org/browse/OJSI-63
CVE: CVE-2019-12131
Published: 2020-03-18
Description: An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP header, an attacker may impersonate an arbitrary existing user without any authentication. All APPC and SDC setups are affected.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290
References: https://jira.onap.org/browse/OJSI-93; https://jira.onap.org/browse/OJSI-93
CVE: CVE-2019-12132
Published: 2020-03-18
Description: An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jira.onap.org/browse/OJSI-41; https://jira.onap.org/browse/OJSI-41
CVE: CVE-2019-12365
Published: 2020-03-18
Description: The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gubello.me; https://newtonhq.com/; https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE: CVE-2019-12366
Published: 2020-03-18
Description: The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://release-notes.9folders.com/; https://gubello.me; https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE: CVE-2019-12367
Published: 2020-03-18
Description: The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gubello.me; https://www.bluemail.me/; https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE: CVE-2019-12368
Published: 2020-03-18
Description: The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gubello.me; https://mail.edison.tech/; https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/
CVE: CVE-2019-12369
Published: 2020-03-18
Description: The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ_EXTERNAL_STORAGE permission.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gubello.me; https://www.gubello.me/blog/javascript-injection-in-six-android-mail-clients/; https://www.typeapp.com/