deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-1408
Published: 2019-10-29
Description: ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
CVSS Score: 8.2 (HIGH)
CWE: CWE-59
References: https://ikiwiki.info/security/#index40h2; https://security-tracker.debian.org/tracker/CVE-2011-1408; https://snyk.io/vuln/SNYK-LINUX-IKIWIKI-133098
CVE: CVE-2018-18929
Published: 2019-10-29
Description: The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be found by a limited user account in an "unattend.xml" file left over on the C: drive from the Sysprep process. An attacker with this username and password can leverage it to gain administrator-level access on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/; https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE: CVE-2018-18930
Published: 2019-10-29
Description: The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. An authenticated attacker can upload a crafted ZIP file (based on an exported backup of existing "Bulletins") containing a malicious file. When uploaded, the system only checks for the presence of the needed files within the ZIP and, as long as the malicious file is named properly, will extract all contained files to a new directory on the system, named with a random GUID. The attacker can determine this GUID by previewing an image from the uploaded Bulletin within the web UI. Once the GUID is determined, the attacker can navigate to the malicious file and execute it. In testing, an ASPX web shell was uploaded, allowing for remote-code execution in the context of a restricted IIS user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/; https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE: CVE-2018-18931
Published: 2019-10-29
Description: An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services directory, an attacker who has gained access to the system can elevate their privileges from a restricted account to full SYSTEM by replacing the Carousel.Service.exe file with a custom malicious executable. This service is independent of the associated IIS web site, which means that this service can be manipulated by an attacker without losing access to vulnerabilities in the web interface (which would potentially be used in conjunction with this attack, to control the service). Once the attacker has replaced Carousel.Service.exe, the server can be restarted using the command "shutdown -r -t 0" from a web shell, causing the system to reboot and launching the malicious Carousel.Service.exe as SYSTEM on startup. If this malicious Carousel.Service.exe is configured to launch a reverse shell back to the attacker, then upon reboot the attacker will have a fully privileged remote command-line environment to manipulate the system further.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/; https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/
CVE: CVE-2018-19151
Published: 2019-10-29
Description: qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requires no stake and can fill the victim's disk and RAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://fc19.ifca.ai/preproceedings/180-preproceedings.pdf; https://medium.com/%40dsl_uiuc/fake-stake-attacks-on-chain-based-proof-of-stake-cryptocurrencies-b8b05723f806; http://fc19.ifca.ai/preproceedings/180-preproceedings.pdf
CVE: CVE-2010-1678
Published: 2019-10-29
Description: Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://people.canonical.com/~ubuntu-security/cve/2010/CVE-2010-1678.html; https://security-tracker.debian.org/tracker/CVE-2010-1678; https://trac.osgeo.org/mapserver/ticket/3641
CVE: CVE-2012-0694
Published: 2019-10-29
Description: SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://seclists.org/bugtraq/2012/Jun/165; https://security-tracker.debian.org/tracker/CVE-2012-0694; https://www.exploit-db.com/exploits/19381
CVE: CVE-2010-2061
Published: 2019-10-29
Description: rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemon is started.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2010-2061; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583435#5; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2061
CVE: CVE-2010-2064
Published: 2019-10-29
Description: rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://access.redhat.com/security/cve/cve-2010-2064; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2064; https://security-tracker.debian.org/tracker/CVE-2010-2064
CVE: CVE-2019-8235
Published: 2019-10-30
Description: An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://magento.com/security/patches/magento-2.3.1-2.2.8-and-2.1.17-security-update; https://magento.com/security/patches/magento-2.3.1-2.2.8-and-2.1.17-security-update
CVE: CVE-2018-5735
Published: 2019-10-30
Description: The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://security-tracker.debian.org/tracker/CVE-2018-5735; https://security-tracker.debian.org/tracker/CVE-2018-5735
CVE: CVE-2018-5742
Published: 2019-10-30
Description: While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also be affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://access.redhat.com/security/cve/cve-2018-5742; https://access.redhat.com/security/cve/cve-2018-5742
CVE: CVE-2019-7619
Published: 2019-10-30
Description: Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908; https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831; https://www.elastic.co/community/security
CVE: CVE-2019-7620
Published: 2019-10-30
Description: Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908; https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909; https://www.elastic.co/community/security
CVE: CVE-2011-2186
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2016-8381
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-9046
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-9047
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2017-14456
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16350
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16351
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16964
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16965
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16966
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16967
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16968
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16969
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16970
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16971
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16972
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16973
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16974
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16975
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16976
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16977
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16978
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16979
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16980
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16981
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16982
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16983
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16984
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16985
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16986
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16987
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16988
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16989
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16990
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16991
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16992
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-16993
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2776
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2778
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-2859
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2018-3869
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4060
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4074
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4075
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4076
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4077
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4078
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4079
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-4080
Published: 2019-10-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2019-15682
Published: 2019-10-30
Description: RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. These issues have been fixed in version 1.8.5
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/10/30/klcert-19-032-denial-of-service-in-rdesktop-before-1-8-4/; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/10/30/klcert-19-032-denial-of-service-in-rdesktop-before-1-8-4/
CVE: CVE-2018-16417
Published: 2019-10-30
Description: Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/108374; https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf; https://www.anquanke.com/vul/id/1652568
CVE: CVE-2018-18678
Published: 2019-10-30
Description: GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d87f2c71fb4fe131465ba1ff0a5d573d; https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172; https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
CVE: CVE-2019-18204
Published: 2019-10-30
Description: Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42; https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE: CVE-2019-18205
Published: 2019-10-30
Description: Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42; https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE: CVE-2019-18206
Published: 2019-10-30
Description: A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42; https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE: CVE-2019-18207
Published: 2019-10-30
Description: In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Title field in the InfoBusiness Web Component. The payload will be triggered every time a user browses the reports page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42; https://blog.hacktivesecurity.com/index.php?controller=post&action=view&id_post=42
CVE: CVE-2010-0206
Published: 2019-10-30
Description: xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0206; https://security-tracker.debian.org/tracker/CVE-2010-0206; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0206
CVE: CVE-2010-0207
Published: 2019-10-30
Description: In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0207; https://security-tracker.debian.org/tracker/CVE-2010-0207; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0207
CVE: CVE-2013-1391
Published: 2019-10-30
Description: Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html; https://www.rapid7.com/db/modules/auxiliary/scanner/misc/dvr_config_disclosure; https://www.securityfocus.com/bid/57579/info