deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13275
Published: 2019-07-04
Description: An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75; https://wordpress.org/plugins/wp-statistics/#developers; https://wpvulndb.com/vulnerabilities/9412
CVE: CVE-2019-13281
Published: 2019-07-04
Description: In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service, an information leak, or possibly unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41841; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
CVE: CVE-2019-13282
Published: 2019-07-04
Description: In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41842; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
CVE: CVE-2019-13283
Published: 2019-07-04
Description: In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41843; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
CVE: CVE-2019-1855
Published: 2019-07-04
Description: A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the Jabber application launches. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user's account.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264, CWE-427
References: http://www.securityfocus.com/bid/109038; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-jabber-dll; http://www.securityfocus.com/bid/109038
CVE: CVE-2019-1884
Published: 2019-07-04
Description: A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for certain fields in HTTP/HTTPS requests sent through an affected device. A successful attacker could exploit this vulnerability by sending a malicious HTTP/HTTPS request through an affected device. An exploit could allow the attacker to force the device to stop processing traffic, resulting in a DoS condition.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-asyncos-wsa; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-asyncos-wsa
CVE: CVE-2019-1886
Published: 2019-07-04
Description: A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Secure Sockets Layer (SSL) server certificates. An attacker could exploit this vulnerability by installing a malformed certificate in a web server and sending a request to it through the Cisco WSA. A successful exploit could allow the attacker to cause an unexpected restart of the proxy process on an affected device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-295
References: http://www.securityfocus.com/bid/109049; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-wsa-dos; http://www.securityfocus.com/bid/109049
CVE: CVE-2019-1889
Published: 2019-07-04
Description: A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checking for the file path when specific software is uploaded. An attacker could exploit this vulnerability by uploading malicious software using the REST API. A successful exploit could allow an attacker to escalate their privilege level to root. The attacker would need to have the administrator role on the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi
CVE: CVE-2019-1890
Published: 2019-07-04
Description: A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, adjacent attacker to bypass security validations and connect an unauthorized server to the infrastructure VLAN. The vulnerability is due to insufficient security requirements during the Link Layer Discovery Protocol (LLDP) setup phase of the infrastructure VLAN. An attacker could exploit this vulnerability by sending a malicious LLDP packet on the adjacent subnet to the Cisco Nexus 9000 Series Switch in ACI mode. A successful exploit could allow the attacker to connect an unauthorized server to the infrastructure VLAN, which is highly privileged. With a connection to the infrastructure VLAN, the attacker can make unauthorized connections to Cisco Application Policy Infrastructure Controller (APIC) services or join other host endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/109052; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-n9kaci-bypass; http://www.securityfocus.com/bid/109052
CVE: CVE-2019-13286
Published: 2019-07-04
Description: In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/PanguL4b/pocs/tree/master/xpdf/heap-buffer-overflow_JBIG2Stream__readTextRegionSeg; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/
CVE: CVE-2019-13287
Published: 2019-07-04
Description: In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-SplashXPath__strokeAdjust; https://github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-SplashXPath__strokeAdjust
CVE: CVE-2019-13288
Published: 2019-07-04
Description: In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/PanguL4b/pocs/tree/master/xpdf/stack-overflow_dos_Parser__getObj; https://github.com/PanguL4b/pocs/tree/master/xpdf/stack-overflow_dos_Parser__getObj
CVE: CVE-2019-13289
Published: 2019-07-04
Description: In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/PanguL4b/pocs/tree/master/xpdf/heap-use-after-free_JBIG2Stream; https://github.com/PanguL4b/pocs/tree/master/xpdf/heap-use-after-free_JBIG2Stream
CVE: CVE-2019-13290
Published: 2019-07-04
Description: Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.ghostscript.com/?p=mupdf.git%3Bh=aaf794439e40a2ef544f15b50c20e657414dec7a; http://git.ghostscript.com/?p=mupdf.git%3Bh=ed19bc806809ad10c4ddce515d375581b86ede85; https://archive.today/oi6bm
CVE: CVE-2019-13291
Published: 2019-07-04
Description: In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41818; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41818
CVE: CVE-2019-13292
Published: 2019-07-04
Description: A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/47013; https://www.exploit-db.com/exploits/47013
CVE: CVE-2019-13294
Published: 2019-07-04
Description: AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-434
References: http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html; https://www.exploit-db.com/exploits/46999; http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html
CVE: CVE-2019-13295
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/a7759f410b773a1dd57b0e1fb28112e1cd8b97bc; https://github.com/ImageMagick/ImageMagick/issues/1608
CVE: CVE-2019-13296
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/ce08a3691a8ac29125e29fc41967b3737fa3f425; https://github.com/ImageMagick/ImageMagick/issues/1604
CVE: CVE-2019-13297
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/604588fc35c7585abb7a9e71f69bb82e4389fefc; https://github.com/ImageMagick/ImageMagick/issues/1609
CVE: CVE-2019-13298
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/d4fc44b58a14f76b1ac997517d742ee12c9dc5d3; https://github.com/ImageMagick/ImageMagick/issues/1611
CVE: CVE-2019-13299
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/8187d2d8fd010d2d6b1a3a8edd935beec404dddc; https://github.com/ImageMagick/ImageMagick/issues/1610
CVE: CVE-2019-13300
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/a906fe9298bf89e01d5272023db[PII_REDACTED]49a; https://github.com/ImageMagick/ImageMagick/issues/1586
CVE: CVE-2019-13301
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/f595a1985233c399a05c0c37cc41de16a90dd025; https://github.com/ImageMagick/ImageMagick/issues/1585
CVE: CVE-2019-13302
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/d5089971bd792311aaab5cb73460326d7ef7f32d; https://github.com/ImageMagick/ImageMagick/issues/1597
CVE: CVE-2019-13303
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/d29148fae06c01ef215940e084cf41853c117bab; https://github.com/ImageMagick/ImageMagick/issues/1603
CVE: CVE-2019-13304
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/7689875ef64f34141e7292f6945efdf0530b4a5e; https://github.com/ImageMagick/ImageMagick/issues/1614
CVE: CVE-2019-13305
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/29efd648f38b73a64d73f14cd2019d869a585888; https://github.com/ImageMagick/ImageMagick/issues/1613
CVE: CVE-2019-13306
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/e92040ea6ee2a844ebfd[PII_REDACTED]795a4787bd; https://github.com/ImageMagick/ImageMagick/issues/1612
CVE: CVE-2019-13307
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/025e77fcb2f45b21689931ba3bf74eac153afa48; https://github.com/ImageMagick/ImageMagick/issues/1615
CVE: CVE-2019-13308
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/61135001a625364e29bdce83832f043eebde7b5a; https://github.com/ImageMagick/ImageMagick/issues/1595
CVE: CVE-2019-13309
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/5f21230b657ccd65452dd3d94c5b5401ba691a2d; https://github.com/ImageMagick/ImageMagick/issues/1616
CVE: CVE-2019-13310
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/5f21230b657ccd65452dd3d94c5b5401ba691a2d; https://github.com/ImageMagick/ImageMagick/issues/1616
CVE: CVE-2019-13311
Published: 2019-07-05
Description: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00069.html; https://github.com/ImageMagick/ImageMagick/commit/4a334bbf5584de37c6f5a47c380a531c8c4b140a; https://github.com/ImageMagick/ImageMagick/issues/1623
CVE: CVE-2019-13312
Published: 2019-07-05
Description: block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://security.gentoo.org/glsa/202003-65; https://security.gentoo.org/glsa/202007-58; https://trac.ffmpeg.org/ticket/7980
CVE: CVE-2019-13144
Published: 2019-07-05
Description: myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://www.mytinytodo.net/history.php; https://www.mytinytodo.net/history.php
CVE: CVE-2019-13313
Published: 2019-07-05
Description: libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2019/07/08/3; https://access.redhat.com/errata/RHSA-2019:3387; https://gitlab.com/libosinfo/libosinfo/-/tags
CVE: CVE-2019-13314
Published: 2019-07-05
Description: virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to virt_bootstrap.py.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00080.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00026.html; http://www.openwall.com/lists/oss-security/2019/07/08/3
CVE: CVE-2019-5960
Published: 2019-07-05
Description: Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN33652328/index.html; https://jvn.jp/en/jp/JVN33652328/index.html
CVE: CVE-2019-5961
Published: 2019-07-05
Description: The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://blog.mastodon-tootdon.com/entry/2019/05/20/204019; https://jvn.jp/en/jp/JVN57806517/index.html; http://blog.mastodon-tootdon.com/entry/2019/05/20/204019
CVE: CVE-2019-5962
Published: 2019-07-05
Description: Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN88962935/index.html; https://wordpress.org/plugins/zoho-salesiq/; https://wpvulndb.com/vulnerabilities/9433
CVE: CVE-2019-5963
Published: 2019-07-05
Description: Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN88962935/index.html; https://wordpress.org/plugins/zoho-salesiq/; https://wpvulndb.com/vulnerabilities/9433
CVE: CVE-2019-5964
Published: 2019-07-05
Description: iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console and operate the product via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://idoors.jp/info/20190701; https://jvn.jp/en/jp/JVN28218613/index.html; https://idoors.jp/info/20190701
CVE: CVE-2019-5965
Published: 2019-07-05
Description: Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://joruri.org/docs/[PII_REDACTED]041/; https://jvn.jp/en/jp/JVN58052567/index.html; https://joruri.org/docs/[PII_REDACTED]041/
CVE: CVE-2019-5966
Published: 2019-07-05
Description: Joruri Mail 2.1.4 and earlier does not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and alter/disclose the information via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://joruri.org/docs/[PII_REDACTED]041/; https://jvn.jp/en/jp/JVN58052567/index.html; https://joruri.org/docs/[PII_REDACTED]041/