deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11080
Published: 2019-06-06
Description: Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html; https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes; https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE
CVE: CVE-2019-12134
Published: 2019-06-06
Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html; https://sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html
CVE: CVE-2019-12732
Published: 2019-06-06
Description: The Chartkick gem through 3.1.0 for Ruby allows XSS.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/ankane/chartkick/blob/master/CHANGELOG.md; https://github.com/ankane/chartkick/issues/488; https://github.com/ankane/chartkick/blob/master/CHANGELOG.md
CVE: CVE-2019-5214
Published: 2019-06-06
Description: There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C00E85R2P20T8). An attacker tricks the user into installing a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-smartphone-en
CVE: CVE-2019-5216
Published: 2019-06-06
Description: There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than Cornell-AL00A 9.0.0.156(C00E156R1P13T8). An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190116-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190116-01-smartphone-en
CVE: CVE-2019-5219
Published: 2019-06-06
Description: There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8). An attacker tricks the user into installing a malicious application, which makes multiple processes operate the same resource at the same time. Successful exploit could cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190130-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190130-01-smartphone-en
CVE: CVE-2019-5241
Published: 2019-06-06
Description: There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run a malicious application to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.
CVSS Score: 7.8 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-pcmanager-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-pcmanager-en
CVE: CVE-2019-5242
Published: 2019-06-06
Description: There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run a malicious application to exploit this vulnerability. Successful exploitation may cause the attacker to execute malicious code and read/write memory.
CVSS Score: 7.8 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-pcmanager-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190109-01-pcmanager-en
CVE: CVE-2019-5295
Published: 2019-06-06
Description: Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability. Due to improper authorization implementation logic, attackers can bypass certain authorization scopes of smart phones by performing specific operations. This vulnerability can be exploited to perform operations beyond the scope of authorization.
CVSS Score: 6.4 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190131-01-phone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190131-01-phone-en
CVE: CVE-2019-5305
Published: 2019-06-06
Description: The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190128-01-ivp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190128-01-ivp-en
CVE: CVE-2019-8320
Published: 2019-06-06
Description: A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
CVSS Score: 7.4 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://access.redhat.com/errata/RHSA-2019:1429; https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html
CVE: CVE-2019-12274
Published: 2019-06-06
Description: In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668, CWE-862
References: https://forums.rancher.com/c/announcements; https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466; https://forums.rancher.com/c/announcements
CVE: CVE-2019-12303
Published: 2019-06-06
Description: In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://forums.rancher.com/c/announcements; https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466; https://forums.rancher.com/c/announcements
CVE: CVE-2019-7220
Published: 2019-06-06
Description: X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.x-cart.com/blog; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-7311
Published: 2019-06-06
Description: An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim's router. The admin password is stored in base64 cleartext in an "admin-auth" cookie. An attacker sniffing the network at the time of login could acquire the router's admin password. Alternatively, gaining physical access to the victim's computer soon after an administrative login could result in compromise.
CVSS Score: 7.8 (HIGH)
CWE: CWE-311
References: http://www.x0rsecurity.com/2019/05/03/my-first-cve-linksys-wrt-1300-acs-cve-2019-7311/; https://robot-security.blogspot.com; http://www.x0rsecurity.com/2019/05/03/my-first-cve-linksys-wrt-1300-acs-cve-2019-7311/
CVE: CVE-2019-7552
Published: 2019-06-06
Description: An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://securityhitlist.blogspot.com/2019/02/cve-2019-7552-php-scripts-mall.html; https://www.phpscriptsmall.com/product/investment-mlm/; https://securityhitlist.blogspot.com/2019/02/cve-2019-7552-php-scripts-mall.html
CVE: CVE-2019-7553
Published: 2019-06-06
Description: PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://securityhitlist.blogspot.com/2019/02/cve-2019-7553-stores-xss-in-php-scripts.html; https://securityhitlist.blogspot.com/2019/02/cve-2019-7553-stores-xss-in-php-scripts.html
CVE: CVE-2019-7554
Published: 2019-06-06
Description: An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://securityhitlist.blogspot.com/2019/02/cve-2019-7554-reflected-xss-in-api.html; https://www.phpscriptsmall.com; https://securityhitlist.blogspot.com/2019/02/cve-2019-7554-reflected-xss-in-api.html
CVE: CVE-2019-12135
Published: 2019-06-06
Description: An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.
CVSS Score: 9.8 (CRITICAL)
References: https://www.papercut.com/products/mf/release-history/; https://www.papercut.com/products/ng/release-history/; https://www.papercut.com/products/mf/release-history/
CVE: CVE-2019-12291
Published: 2019-06-06
Description: HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
CVSS Score: 7.5 (HIGH)
References: https://github.com/hashicorp/consul/issues/5888; https://github.com/hashicorp/consul/issues/5888
CVE: CVE-2019-7215
Published: 2019-06-06
Description: Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D; https://knowledgebase.progress.com/articles/Article/Security-Advisory-For-Resolving-Security-Vulnerabilities-May-2019; https://knowledgebase.progress.com/#sort=relevancy&f:%40objecttypelabel=%5BProduct%20Alert%5D
CVE: CVE-2019-9929
Published: 2019-06-06
Description: Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://cfengine.com/company/blog-detail/cve-2019-9929-internal-authentication-secrets-leaked-in-logs/; https://cfengine.com/product/latest-release/; https://cfengine.com/company/blog-detail/cve-2019-9929-internal-authentication-secrets-leaked-in-logs/
CVE: CVE-2019-6989
Published: 2019-06-06
Description: TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. By sending specially crafted ICMP echo request packets, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/152458/TP-LINK-TL-WR940N-TL-WR941ND-Buffer-Overflow.html; https://www.exploit-db.com/exploits/46678/; http://packetstormsecurity.com/files/152458/TP-LINK-TL-WR940N-TL-WR941ND-Buffer-Overflow.html
CVE: CVE-2018-8047
Published: 2019-06-06
Description: vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List (app parameter).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-001; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-001
CVE: CVE-2018-9839
Published: 2019-06-06
Description: An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/mantisbt/mantisbt/commit/1fbcd9bca2f2c77cb61624d36ddee4b3802c38ea; https://mantisbt.org/bugs/view.php?id=24221; https://github.com/mantisbt/mantisbt/commit/1fbcd9bca2f2c77cb61624d36ddee4b3802c38ea
CVE: CVE-2019-12760
Published: 2019-06-06
Description: A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.
CVSS Score: 3.3 (LOW)
CWE: CWE-502
References: https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7; https://github.com/davidhalter/parso/issues/75; https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7
CVE: CVE-2019-12761
Published: 2019-06-06
Description: A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba; https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html; https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html
CVE: CVE-2019-3578
Published: 2019-06-06
Description: MyBB 1.8.19 has XSS in the resetpassword function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.mybb.com/; https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/; https://blog.mybb.com/
CVE: CVE-2019-3579
Published: 2019-06-06
Description: MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://blog.mybb.com/; https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/; https://blog.mybb.com/
CVE: CVE-2019-3722
Published: 2019-06-06
Description: Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/108685; https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en; http://www.securityfocus.com/bid/108685
CVE: CVE-2019-3723
Published: 2019-06-06
Description: Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete the contents of any existing file, due to improper input parameter validation
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108685; https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en; http://www.securityfocus.com/bid/108685
CVE: CVE-2019-3790
Published: 2019-06-06
Description: The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-324, CWE-613
References: http://www.securityfocus.com/bid/108512; https://pivotal.io/security/cve-2019-3790; http://www.securityfocus.com/bid/108512
CVE: CVE-2019-5522
Published: 2019-06-06
Description: VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with VMware Tools installed may be able to leak kernel information or create a denial of service attack on the same Windows guest machine.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108673; https://www.vmware.com/security/advisories/VMSA-2019-0009.html; http://www.securityfocus.com/bid/108673
CVE: CVE-2019-5525
Published: 2019-06-06
Description: VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. A malicious user with normal user privileges on the guest machine may exploit this issue in conjunction with other issues to execute code on the Linux host where Workstation is installed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108674; https://www.vmware.com/security/advisories/VMSA-2019-0009.html; http://www.securityfocus.com/bid/108674
CVE: CVE-2019-6451
Published: 2019-06-06
Description: On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://www.nccst.nat.gov.tw; http://www.soyal.com/epaper/e-paper-en-117.html; https://github.com/cvereveal/CVEs/tree/master/CVE-2019-6451
CVE: CVE-2019-6452
Published: 2019-06-06
Description: Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to obtain a cleartext FTP or SMB password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.nccst.nat.gov.tw; https://github.com/cvereveal/CVEs/tree/master/CVE-2019-6452; http://www.nccst.nat.gov.tw
CVE: CVE-2019-11523
Published: 2019-06-06
Description: Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list (which includes RFID codes and passcodes in cleartext), or update/create users. The same attack can be executed on a local network and over the internet (if the device is exposed on a public IP address).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-311
References: https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc; https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc
CVE: CVE-2019-12492
Published: 2019-06-06
Description: Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the FT Command Centre Service and FT Controller Service services.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://security.gallagher.com/CVE-2019-12492; https://security.gallagher.com/security-advisories; https://security.gallagher.com/CVE-2019-12492
CVE: CVE-2019-12762
Published: 2019-06-06
Description: Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated by a transmitter and antenna hidden just beneath the surface of a coffee-shop table, aka Ghost Touch.
CVSS Score: 4.2 (MEDIUM)
References: https://hackercombat.com/nfc-vulnerability-may-promote-ghost-screen-taps/; https://medium.com/%40juliodellaflora/ghost-touch-on-xiaomi-mi5s-plus[PII_REDACTED]07; https://hackercombat.com/nfc-vulnerability-may-promote-ghost-screen-taps/
CVE: CVE-2019-4161
Published: 2019-06-06
Description: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 158660.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158660; https://www.ibm.com/support/docview.wss?uid=ibm10885959; https://exchange.xforce.ibmcloud.com/vulnerabilities/158660
CVE: CVE-2019-4162
Published: 2019-06-06
Description: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. IBM X-Force ID: 158661.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158661; https://www.ibm.com/support/docview.wss?uid=ibm10885963; https://exchange.xforce.ibmcloud.com/vulnerabilities/158661
CVE: CVE-2019-4217
Published: 2019-06-06
Description: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 159226.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159226; https://www.ibm.com/support/docview.wss?uid=ibm10886051; https://exchange.xforce.ibmcloud.com/vulnerabilities/159226
CVE: CVE-2019-4218
Published: 2019-06-06
Description: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 159227.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159227; https://www.ibm.com/support/docview.wss?uid=ibm10886061; https://exchange.xforce.ibmcloud.com/vulnerabilities/159227