deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13539
Published: 2019-11-08
Description: Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.
CVSS Score: 7.0 (HIGH)
CWE: CWE-328, CWE-326
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-02; https://www.us-cert.gov/ics/advisories/icsma-19-311-02
CVE: CVE-2019-13543
Published: 2019-11-08
Description: Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. If discovered, they can be used to read files on the device.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-311-02; https://www.us-cert.gov/ics/advisories/icsma-19-311-02
CVE: CVE-2018-1721
Published: 2019-11-09
Description: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or cause the web server to make HTTP requests to arbitrary domains. IBM X-Force ID: 147369.
CVSS Score: 8.8 (HIGH)
CWE: CWE-91
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147369; https://www.ibm.com/support/pages/node/1074144; https://exchange.xforce.ibmcloud.com/vulnerabilities/147369
CVE: CVE-2019-4334
Published: 2019-11-09
Description: IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/161271; https://www.ibm.com/support/pages/node/1074144; https://exchange.xforce.ibmcloud.com/vulnerabilities/161271
CVE: CVE-2019-4411
Published: 2019-11-09
Description: IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-330
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162658; https://www.ibm.com/support/pages/node/1086123; https://exchange.xforce.ibmcloud.com/vulnerabilities/162658
CVE: CVE-2019-4412
Published: 2019-11-09
Description: IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 162659.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162659; https://www.ibm.com/support/pages/node/1086123; https://exchange.xforce.ibmcloud.com/vulnerabilities/162659
CVE: CVE-2019-4450
Published: 2019-11-09
Description: IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163492.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163492; https://www.ibm.com/support/pages/node/1100085; https://exchange.xforce.ibmcloud.com/vulnerabilities/163492
CVE: CVE-2019-4454
Published: 2019-11-09
Description: IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163618.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163618; https://www.ibm.com/support/pages/node/1103499; https://exchange.xforce.ibmcloud.com/vulnerabilities/163618
CVE: CVE-2019-4470
Published: 2019-11-09
Description: IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163779.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163779; https://www.ibm.com/support/pages/node/1103517; https://exchange.xforce.ibmcloud.com/vulnerabilities/163779
CVE: CVE-2019-4509
Published: 2019-11-09
Description: IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164430; https://www.ibm.com/support/pages/node/1103931; https://exchange.xforce.ibmcloud.com/vulnerabilities/164430
CVE: CVE-2019-4556
Published: 2019-11-09
Description: IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 166205.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166205; https://www.ibm.com/support/pages/node/1102443; https://exchange.xforce.ibmcloud.com/vulnerabilities/166205
CVE: CVE-2019-4581
Published: 2019-11-09
Description: IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 167239.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167239; https://www.ibm.com/support/pages/node/1103373; https://exchange.xforce.ibmcloud.com/vulnerabilities/167239
CVE: CVE-2019-4645
Published: 2019-11-09
Description: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170881.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170881; https://www.ibm.com/support/pages/node/1074144; https://exchange.xforce.ibmcloud.com/vulnerabilities/170881
CVE: CVE-2019-5689
Published: 2019-11-09
Description: NVIDIA GeForce Experience, all versions prior to 3.20.1, contains a vulnerability in the Downloader component in which a user with local system access can craft input that may allow malicious files to be downloaded and saved. This behavior may lead to code execution, denial of service, or information disclosure.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4860; https://nvidia.custhelp.com/app/answers/detail/a_id/4860
CVE: CVE-2019-5690
Published: 2019-11-09
Description: NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the size of an input buffer is not validated, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5691
Published: 2019-11-09
Description: NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a NULL pointer is dereferenced, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5692
Published: 2019-11-09
Description: NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the product uses untrusted input when calculating or using an array index, which may lead to escalation of privileges or denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5693
Published: 2019-11-09
Description: NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) in which the program accesses or uses a pointer that has not been initialized, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5694
Published: 2019-11-09
Description: NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution. The attacker requires local system access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://safebreach.com/Post/NVIDIA-GPU-Display-Drivers-for-Windows-and-GFE-Software-DLL-Preloading-and-Potential-Abuses-CVE-2019-5694-CVE-2019-5695; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5696
Published: 2019-11-09
Description: NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in which the provision of an incorrectly sized buffer by a guest VM leads to GPU out-of-bound access, which may lead to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-131
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5697
Published: 2019-11-09
Description: NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in which it may grant a guest access to memory that it does not own, which may lead to information disclosure or denial of service.
CVSS Score: 7.1 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5698
Published: 2019-11-09
Description: NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in the vGPU plugin, in which an input index value is incorrectly validated, which may lead to denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-129
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4907; https://nvidia.custhelp.com/app/answers/detail/a_id/4907
CVE: CVE-2019-5701
Published: 2019-11-09
Description: NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access can load the Intel graphics driver DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service, information disclosure, or escalation of privileges through code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-011.md; https://nvidia.custhelp.com/app/answers/detail/a_id/4860; https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-011.md
CVE: CVE-2009-0035
Published: 2019-11-09
Description: alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://access.redhat.com/security/cve/cve-2009-0035; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0035; https://security-tracker.debian.org/tracker/CVE-2009-0035
CVE: CVE-2009-2802
Published: 2019-11-09
Description: MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mantisbt.org/blog/archives/mantisbt/113; https://mantisbt.org/bugs/view.php?id=11952; https://security-tracker.debian.org/tracker/CVE-2009-2802
CVE: CVE-2009-3552
Published: 2019-11-09
Description: In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform.
CVSS Score: 3.1 (LOW)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2009-3552; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3552; https://www.securityfocus.com/bid/42639
CVE: CVE-2009-3614
Published: 2019-11-09
Description: liboping 1.3.2 allows users reading arbitrary files upon the local system.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2009-3614; https://security-tracker.debian.org/tracker/CVE-2009-3614; https://access.redhat.com/security/cve/cve-2009-3614
CVE: CVE-2009-4011
Published: 2019-11-09
Description: dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a potentially reuse an already opened VPS console.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://bugs.launchpad.net/ubuntu/+source/dtc-xen/+bug/505072; https://security-tracker.debian.org/tracker/CVE-2009-4011; https://tracker.debian.org/media/packages/d/dtc-xen/changelog-0.5.17-1.1
CVE: CVE-2009-5004
Published: 2019-11-09
Description: qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use .
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2009-5004; https://bugzilla.redhat.com/show_bug.cgi?id=501792; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-5004
CVE: CVE-2019-18840
Published: 2019-11-09
Description: In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/wolfSSL/wolfssl/issues/2555; https://github.com/wolfSSL/wolfssl/issues/2555
CVE: CVE-2019-18845
Published: 2019-11-09
Description: The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-012.md; https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-012.md
CVE: CVE-2019-18836
Published: 2019-11-11
Description: Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://blog.envoyproxy.io; https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xvf-4396-cj46; https://github.com/istio/istio/issues/18229
CVE: CVE-2019-18841
Published: 2019-11-11
Description: Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.
CVSS Score: 7.3 (HIGH)
References: https://chartkick.com; https://github.com/ankane/chartkick.js/issues/117; https://github.com/ankane/chartkick/blob/master/CHANGELOG.md
CVE: CVE-2019-18849
Published: 2019-11-11
Description: In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18; https://github.com/verdammelt/tnef/pull/40; https://lists.debian.org/debian-lts-announce/2019/11/msg00035.html
CVE: CVE-2019-18852
Published: 2019-11-11
Description: Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This affects DIR-600 B1 V2.01 for WW, DIR-890L A1 v1.03, DIR-615 J1 v100 (for DCN), DIR-645 A1 v1.03, DIR-815 A1 v1.01, DIR-823 A1 v1.01, and DIR-842 C1 v3.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdf; https://github.com/ChandlerChin/Dlink_vuls/blob/master/A%20hard%20coded%20telnet%20user%20was%20discovered%20in%20multiple%20Dlink%20routers.pdf
CVE: CVE-2019-18853
Published: 2019-11-11
Description: ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://fortiguard.com/zeroday/FG-VD-19-136; https://github.com/ImageMagick/ImageMagick/commit/ec9c8944af2bfc65c697ca44f93a727a99b405f1; https://fortiguard.com/zeroday/FG-VD-19-136
CVE: CVE-2019-18854
Published: 2019-11-11
Description: A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://fortiguard.com/zeroday/FG-VD-19-113; https://plugins.trac.wordpress.org/changeset/2185438; https://wordpress.org/plugins/safe-svg/#developers
CVE: CVE-2019-18855
Published: 2019-11-11
Description: A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
CVSS Score: 7.5 (HIGH)
References: https://fortiguard.com/zeroday/FG-VD-19-113; https://plugins.trac.wordpress.org/changeset/2185438; https://wordpress.org/plugins/safe-svg/#developers
CVE: CVE-2019-18856
Published: 2019-11-11
Description: A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://fortiguard.com/zeroday/FG-VD-19-115; https://git.drupalcode.org/project/svg_sanitizer/commit/e1b0666; https://fortiguard.com/zeroday/FG-VD-19-115
CVE: CVE-2019-18857
Published: 2019-11-11
Description: darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0; https://github.com/darylldoyle/svg-sanitizer/compare/0.11.0...0.12.0; https://github.com/darylldoyle/svg-sanitizer/commit/51ca4b713f3706d6b27769c6296bbc0c28a5bbd0
CVE: CVE-2019-18862
Published: 2019-11-11
Description: maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/155425/GNU-Mailutils-3.7-Privilege-Escalation.html; https://git.savannah.gnu.org/cgit/mailutils.git/tree/NEWS; https://security.gentoo.org/glsa/202006-12
CVE: CVE-2019-18873
Published: 2019-11-12
Description: FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78, CWE-79
References: https://github.com/fuzzlove/FUDforum-XSS-RCE; https://sourceforge.net/p/fudforum/code/6321/; https://github.com/fuzzlove/FUDforum-XSS-RCE
CVE: CVE-2019-18874
Published: 2019-11-12
Description: psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/giampaolo/psutil/pull/1616; https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS/
CVE: CVE-2019-18881
Published: 2019-11-12
Description: WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625
CVE: CVE-2019-18882
Published: 2019-11-12
Description: WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0625
CVE: CVE-2011-2897
Published: 2019-11-12
Description: gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2011-2897; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2897; https://security-tracker.debian.org/tracker/CVE-2011-2897
CVE: CVE-2011-2936
Published: 2019-11-12
Description: Elgg through 1.7.10 has a SQL injection vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://access.redhat.com/security/cve/cve-2011-2936; https://oss-security.openwall.narkive.com/1UH3NYx8/cve-request-elgg-1-7-10-multiple-vulnerabilities; https://security-tracker.debian.org/tracker/CVE-2011-2936
CVE: CVE-2011-3370
Published: 2019-11-12
Description: statusnet before 0.9.9 has XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2011-3370; https://seclists.org/oss-sec/2011/q3/488; https://security-tracker.debian.org/tracker/CVE-2011-3370