deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5474
Published: 2019-12-30
Description: The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-311
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092841.html; https://access.redhat.com/security/cve/cve-2012-5474; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5474
CVE: CVE-2012-5476
Published: 2019-12-30
Description: Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/cve-2012-5476; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5476; https://security-tracker.debian.org/tracker/CVE-2012-5476
CVE: CVE-2012-5645
Published: 2019-12-30
Description: A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095378.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095381.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-January/096391.html
CVE: CVE-2018-7859
Published: 2019-12-30
Description: A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10082; http://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10082
CVE: CVE-2019-16790
Published: 2019-12-30
Description: In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-434
References: https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8; https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr; https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8
CVE: CVE-2019-19031
Published: 2019-12-30
Description: Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://packetstormsecurity.com/files/155996/Easy-XML-Editor-1.7.8-XML-Injection.html; https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml/; http://packetstormsecurity.com/files/155996/Easy-XML-Editor-1.7.8-XML-Injection.html
CVE: CVE-2019-19032
Published: 2019-12-30
Description: XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.
CVSS Score: 8.1 (HIGH)
CWE: CWE-611
References: http://packetstormsecurity.com/files/156139/XMLBlueprint-16.191112-XML-Injection.html; https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml/; http://packetstormsecurity.com/files/156139/XMLBlueprint-16.191112-XML-Injection.html
CVE: CVE-2012-5663
Published: 2019-12-30
Description: The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp).
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-459
References: http://gnats.netbsd.org/47360; http://www.openwall.com/lists/oss-security/2012/12/21/2; http://www.openwall.com/lists/oss-security/2012/12/21/3
CVE: CVE-2013-0196
Published: 2019-12-30
Description: A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2013-0196; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0196; https://access.redhat.com/security/cve/cve-2013-0196
CVE: CVE-2013-0264
Published: 2019-12-30
Description: An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2013-0264; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0264; https://access.redhat.com/security/cve/cve-2013-0264
CVE: CVE-2013-2016
Published: 2019-12-30
Description: A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00002.html; http://www.openwall.com/lists/oss-security/2013/04/29/5; http://www.openwall.com/lists/oss-security/2013/04/29/6
CVE: CVE-2018-20488
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/53477; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20489
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-foss/issues/41500; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20490
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54377; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20491
Published: 2019-12-30
Description: An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54008; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20493
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54914; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20494
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54334; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20495
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51969; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20496
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54427; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20497
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51327; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20498
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/50995; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20499
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55439; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20501
Published: 2019-12-30
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/53543; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-20507
Published: 2019-12-30
Description: An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2019-20159
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a memory leak in dinf_New() in isomedia/box_code_base.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/issues/1321; https://github.com/gpac/gpac/issues/1321
CVE: CVE-2019-20160
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a stack-based buffer overflow in the function av1_parse_tile_group() in media_tools/av_parsers.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1334; https://github.com/gpac/gpac/issues/1334
CVE: CVE-2019-20161
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1320; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1320
CVE: CVE-2019-20162
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1327; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1327
CVE: CVE-2019-20163
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_odf_avc_cfg_write_bs() in odf/descriptors.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1335; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1335
CVE: CVE-2019-20164
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_box_del() in isomedia/box_funcs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1332; https://github.com/gpac/gpac/issues/1332
CVE: CVE-2019-20165
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function ilst_item_Read() in isomedia/box_code_apple.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1338; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1338
CVE: CVE-2019-20166
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_dump() in isomedia/box_dump.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1331; https://github.com/gpac/gpac/issues/1331
CVE: CVE-2019-20167
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function senc_Parse() in isomedia/box_code_drm.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1330; https://github.com/gpac/gpac/issues/1330
CVE: CVE-2019-20168
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function gf_isom_box_dump_ex() in isomedia/box_funcs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/gpac/gpac/issues/1333; https://github.com/gpac/gpac/issues/1333
CVE: CVE-2019-20169
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function trak_Read() in isomedia/box_code_base.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/gpac/gpac/issues/1329; https://github.com/gpac/gpac/issues/1329
CVE: CVE-2019-20170
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-763
References: https://github.com/gpac/gpac/issues/1328; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1328
CVE: CVE-2019-20171
Published: 2019-12-31
Description: An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/blob/v0.5.2/src/isomedia/box_code_adobe.c; https://github.com/gpac/gpac/issues/1337; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html
CVE: CVE-2019-7478
Published: 2019-12-31
Description: A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS versions GMS 8.4, 8.5, 8.6, 8.7, 9.0 and 9.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0011; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0011
CVE: CVE-2019-19927
Published: 2019-12-31
Description: In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and performing some operations can lead to slab-out-of-bounds read access in ttm_put_pages in drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related to the vmwgfx or ttm module.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19927; https://github.com/torvalds/linux/commit/453393369dc9806d2455151e329c[PII_REDACTED]28
CVE: CVE-2019-7479
Published: 2019-12-31
Description: A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n, 6.5.3.3-3n, 6.5.1.9-4n and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
CVSS Score: 7.2 (HIGH)
CWE: CWE-285, CWE-269
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0012; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0012
CVE: CVE-2019-20172
Published: 2019-12-31
Description: Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/Fire30/CTF-WRITEUPS/tree/master/36c3_ctf/wisdom; https://github.com/SerenityOS/serenity/commit/0fc24fe[PII_REDACTED]859e7edfa177a86dac36bf9; https://github.com/Fire30/CTF-WRITEUPS/tree/master/36c3_ctf/wisdom
CVE: CVE-2019-20175
Published: 2019-12-31
Description: An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html; https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html; https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg00597.html
CVE: CVE-2019-10229
Published: 2019-12-31
Description: An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login attempt.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://help.mailstore.com/security/MAILSTORE-SA-2019-01.txt; https://help.mailstore.com/security/MAILSTORE-SA-2019-01.txt
CVE: CVE-2019-12186
Published: 2019-12-31
Description: An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sylius.com/blog/cve-2019-12186/; https://sylius.com/blog/cve-2019-12186/
CVE: CVE-2019-12273
Published: 2019-12-31
Description: OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: The product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.) NOTE: The vendor claims that the independent researcher created the report without any type of validation and that no such vulnerability exists
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-20176
Published: 2019-12-31
Description: In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/jedisct1/pure-ftpd/commit/aea56f4bcb9948d456f3fae4d044fd3fa2e19706; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AHZG5FPCRMCB6Z3L7FPICC6BZ5ZATFTO/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICL3U2J4EPGBLOE555Y5RAZTQL3WBBV/
CVE: CVE-2019-7162
Published: 2019-12-31
Description: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
CVSS Score: 9.1 (CRITICAL)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7162; https://www.excellium-services.com/cert-xlm-advisory; https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162/
CVE: CVE-2018-14476
Published: 2019-12-31
Description: GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151006/GeniXCMS-1.1.5-Cross-Site-Scripting.html; https://github.com/semplon/GeniXCMS/issues/88; http://packetstormsecurity.com/files/151006/GeniXCMS-1.1.5-Cross-Site-Scripting.html