deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19378
Published: 2019-11-29
Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19378; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19378
CVE: CVE-2019-16767
Published: 2019-11-29
Description: The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-250
References: https://github.com/Inist-CNRS/ezmaster/blob/master/CHANGELOG.md#ezmaster-5211; https://github.com/Inist-CNRS/ezmaster/pull/51; https://github.com/Inist-CNRS/ezmaster/security/advisories/GHSA-g654-5qjf-g6cx
CVE: CVE-2019-18922
Published: 2019-11-29
Description: A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155504/Allied-Telesis-AT-GS950-8-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/Nov/31; https://pastebin.com/dpEGKUGz
CVE: CVE-2019-5226
Published: 2019-11-29
Description: P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1) and HiSuite with versions earlier than HiSuite 9.1.0.305 have a version downgrade vulnerability. The device and HiSuite software do not validate the upgrade package sufficiently, so that the system of smartphone can be downgraded to an older version.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en
CVE: CVE-2019-5210
Published: 2019-11-29
Description: Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190(C00E190R6P2)and Versions earlier than 9.1.1.175(C00E170R3P2) have an improper validation of array index vulnerability. The system does not properly validate the input value before use it as an array index when processing certain image information. The attacker tricks the user into installing a malicious application, successful exploit could cause malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191120-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191120-01-smartphone-en
CVE: CVE-2019-5211
Published: 2019-11-29
Description: The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management vulnerability. The attacker tricks the victim to perform certain operations on the mobile phone during file transfer. Because the file is not properly processed, successfully exploit may cause some files on the victim's mobile phone are deleted.
CVSS Score: 5.7 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-02-share-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-02-share-en
CVE: CVE-2019-5212
Published: 2019-11-29
Description: There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishing a connect to the attacker through Huawei Share, successful exploit could cause information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-share-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-share-en
CVE: CVE-2019-5218
Published: 2019-11-29
Description: There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect to it in certain scenario. Successful exploit could allow the attacker to spoof then connect to the band.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191106-01-band-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191106-01-band-en
CVE: CVE-2019-5224
Published: 2019-11-29
Description: P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21) have an out of bounds read vulnerability. The system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause out of bounds read and information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-03-smartphone-en
CVE: CVE-2019-5225
Published: 2019-11-29
Description: P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) have a buffer overflow vulnerability on several , the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause malicious code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-02-smartphone-en
CVE: CVE-2019-5227
Published: 2019-11-29
Description: P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R2P1), versions earlier than Hima-AL00B 9.1.0.135(C00E133R2P1) and HiSuite with versions earlier than HiSuite 9.1.0.305 have a version downgrade vulnerability. The device and HiSuite software do not validate the upgrade package sufficiently, so that the system of smartphone can be downgraded to an older version.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190904-01-smartphone-en
CVE: CVE-2019-5232
Published: 2019-11-29
Description: There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191120-01-viewpoint-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191120-01-viewpoint-en
CVE: CVE-2019-5263
Published: 2019-11-29
Description: HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing encrypted backup data vulnerability. Huawei smartphone user backup information can be obtained by brute forcing the password for encrypting the backup.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-307
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-01-backup-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190821-01-backup-en
CVE: CVE-2019-5269
Published: 2019-11-29
Description: Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege.
CVSS Score: 7.8 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en
CVE: CVE-2015-1855
Published: 2019-11-29
Description: verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2015/dsa-3245; http://www.debian.org/security/2015/dsa-3246; http://www.debian.org/security/2015/dsa-3247
CVE: CVE-2015-2060
Published: 2019-11-29
Description: cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151145.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151147.html; http://www.cabextract.org.uk/
CVE: CVE-2015-3406
Published: 2019-11-29
Description: The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: http://ubuntu.com/usn/usn-2607-1; http://www.openwall.com/lists/oss-security/2015/04/07/1; http://www.openwall.com/lists/oss-security/2015/04/23/17
CVE: CVE-2019-5247
Published: 2019-11-29
Description: Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific parameter and send to the process to exploit this vulnerability. Successfully exploit may cause service crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-atlas-en
CVE: CVE-2019-5268
Published: 2019-11-29
Description: Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en
CVE: CVE-2019-5271
Published: 2019-11-29
Description: There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly processes some data. Attackers can exploit this vulnerability to read and modify specific configurations of speakers through a series of operations.
CVSS Score: 5.4 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-myna-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-myna-en
CVE: CVE-2019-5308
Published: 2019-11-29
Description: Mate 20 RS smartphones with versions earlier than 9.1.0.135(C786E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation in ADB mode, successful exploit could allow the attacker to switch to third desktop after a series of operation.
CVSS Score: 2.4 (LOW)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-01-smartphone-en
CVE: CVE-2019-5309
Published: 2019-11-29
Description: Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could view certain information after a series of operation without unlock the screen lock. Successful exploit could cause an information disclosure condition.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-307
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191127-02-smartphone-en
CVE: CVE-2014-3591
Published: 2019-11-29
Description: Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: http://www.cs.tau.ac.il/~tromer/radioexp/; http://www.debian.org/security/2015/dsa-3184; http://www.debian.org/security/2015/dsa-3185
CVE: CVE-2015-0837
Published: 2019-11-29
Description: The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://www.debian.org/security/2015/dsa-3184; http://www.debian.org/security/2015/dsa-3185; https://ieeexplore.ieee.org/document/7163050
CVE: CVE-2019-19396
Published: 2019-11-29
Description: illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg concurrently over a single socket, because uts/common/inet/ip/ip_attr.c mishandles conn_ixa dereferences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://omniosce.org/article/030y-028ay-022dw.html; https://www.illumos.org/issues/11556; https://omniosce.org/article/030y-028ay-022dw.html
CVE: CVE-2019-19451
Published: 2019-11-29
Description: When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00019.html; https://gitlab.gnome.org/GNOME/dia/issues/428; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KTGLGWHINMTDRFL7RZAJZJM5YSVXUXWW/
CVE: CVE-2019-19462
Published: 2019-11-30
Description: relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
CVE: CVE-2013-7484
Published: 2019-11-30
Description: Zabbix before 5.0 represents passwords in the users table with unsalted MD5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html; https://support.zabbix.com/browse/ZBX-16551; https://support.zabbix.com/browse/ZBXNEXT-1898
CVE: CVE-2019-19463
Published: 2019-11-30
Description: The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://www.info-sec.ca/advisories/Huami-Mi-Fit.html; https://www.info-sec.ca/advisories/Huami-Mi-Fit.html
CVE: CVE-2019-19464
Published: 2019-11-30
Description: The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://www.info-sec.ca/advisories/CBC-Gem.html; https://www.info-sec.ca/advisories/CBC-Gem.html
CVE: CVE-2019-19468
Published: 2019-11-30
Description: Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers a malformed SEH, as demonstrated by a 0012ECB4 FreePhot.[PII_REDACTED] corrupt entry.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://code610.blogspot.com/2019/11/from-0-to-0day-quick-fuzzing-lesson.html; https://code610.blogspot.com/2019/11/from-0-to-0day-quick-fuzzing-lesson.html
CVE: CVE-2019-19269
Published: 2019-11-30
Description: An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html; https://github.com/proftpd/proftpd/issues/861; https://lists.debian.org/debian-lts-announce/2019/11/msg00039.html
CVE: CVE-2019-19469
Published: 2019-12-01
Description: In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metacharacters. This may depend on weak default credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-352
References: https://github.com/robertchrk/zmanda_exploit; https://github.com/robertchrk/zmanda_exploit
CVE: CVE-2019-18609
Published: 2019-12-01
Description: An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/alanxz/rabbitmq-c/blob/master/ChangeLog.md; https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a; https://lists.debian.org/debian-lts-announce/2019/12/msg00004.html
CVE: CVE-2019-19479
Published: 2019-12-01
Description: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2019/12/29/1; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693; https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b63de2
CVE: CVE-2019-19480
Published: 2019-12-01
Description: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-672
References: http://www.openwall.com/lists/oss-security/2019/12/29/1; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478; https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b1d4fe8ff9d2e6a3f5ee02c7
CVE: CVE-2019-19481
Published: 2019-12-01
Description: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2019/12/29/1; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618; https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a94278
CVE: CVE-2019-15631
Published: 2019-12-02
Description: Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://help.salesforce.com/articleView?id=000351827&language=en_US&type=1&mode=1; https://help.salesforce.com/articleView?id=000351827&language=en_US&type=1&mode=1
CVE: CVE-2019-19489
Published: 2019-12-02
Description: SMPlayer 19.5.0 has a buffer overflow via a long .m3u file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.exploit-db.com/exploits/47709; https://www.exploit-db.com/exploits/47709
CVE: CVE-2019-19490
Published: 2019-12-02
Description: LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://www.exploit-db.com/exploits/47706; https://www.exploit-db.com/exploits/47706
CVE: CVE-2019-19491
Published: 2019-12-02
Description: TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/47702; https://www.exploit-db.com/exploits/47702
CVE: CVE-2019-19492
Published: 2019-12-02
Description: FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.exploit-db.com/exploits/47698; https://www.exploit-db.com/exploits/47698
CVE: CVE-2019-19362
Published: 2019-12-02
Description: An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-212
References: http://nestedif.com/teamviewer-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory/; http://nestedif.com/teamviewer-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory/
CVE: CVE-2019-19493
Published: 2019-12-02
Description: Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434, CWE-706
References: http://packetstormsecurity.com/files/159525/Kentico-CMS-9.0-12.0.49-Cross-Site-Scripting.html; https://devnet.kentico.com/download/hotfixes; http://packetstormsecurity.com/files/159525/Kentico-CMS-9.0-12.0.49-Cross-Site-Scripting.html
CVE: CVE-2019-19496
Published: 2019-12-02
Description: Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/vipinxsec/Alfresco_XSS/blob/master/README.md; https://vipinxsec.blogspot.com/2019/11/alfresco-stored-xss-vulnerability-blind.html; https://github.com/vipinxsec/Alfresco_XSS/blob/master/README.md