deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6619
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.
CVSS Score: 8.8 (HIGH)
CWE: CWE-617
References: https://github.com/nothings/stb/issues/863; https://github.com/nothings/stb/issues/863
CVE: CVE-2020-6620
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/nothings/stb/issues/868; https://github.com/nothings/stb/issues/868
CVE: CVE-2020-6621
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/nothings/stb/issues/867; https://github.com/nothings/stb/issues/867
CVE: CVE-2020-6622
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/nothings/stb/issues/869; https://github.com/nothings/stb/issues/869
CVE: CVE-2020-6623
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.
CVSS Score: 8.8 (HIGH)
CWE: CWE-617
References: https://github.com/nothings/stb/issues/865; https://github.com/nothings/stb/issues/865
CVE: CVE-2019-11292
Published: 2020-01-09
Description: Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://pivotal.io/security/cve-2019-11292; https://pivotal.io/security/cve-2019-11292
CVE: CVE-2020-6624
Published: 2020-01-09
Description: jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugs.gentoo.org/711220#c3; https://bugs.gentoo.org/876247#c0; https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1858744
CVE: CVE-2020-6625
Published: 2020-01-09
Description: jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://bugs.gentoo.org/711220#c3; https://bugs.gentoo.org/876247#c0; https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1858746
CVE: CVE-2019-16773
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-20042. Reason: This candidate is a duplicate of CVE-2019-20042. Notes: All CVE users should reference CVE-2019-20042 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-5205
Published: 2020-01-09
Description: In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07; https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f; https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw
CVE: CVE-2020-6628
Published: 2020-01-09
Description: Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/libming/libming/issues/191; https://github.com/libming/libming/issues/191
CVE: CVE-2020-6629
Published: 2020-01-09
Description: Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libming/libming/issues/190; https://github.com/libming/libming/issues/190
CVE: CVE-2020-6630
Published: 2020-01-09
Description: An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_isom_get_media_data_size() in isomedia/isom_read.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1377; https://github.com/gpac/gpac/issues/1377
CVE: CVE-2020-6631
Published: 2020-01-09
Description: An issue was discovered in GPAC version 0.8.0. There is a NULL pointer dereference in the function gf_m2ts_stream_process_pmt() in media_tools/m2ts_mux.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1378; https://github.com/gpac/gpac/issues/1378
CVE: CVE-2020-6632
Published: 2020-01-09
Description: In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PrestaShop/PrestaShop/pull/17050/commits; https://github.com/PrestaShop/PrestaShop/pull/17050/commits
CVE: CVE-2019-16788
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-20043. Reason: This candidate is a duplicate of CVE-2019-20043. Notes: All CVE users should reference CVE-2019-20043 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-2650
Published: 2020-01-09
Description: Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx; https://networks.unify.com/security/advisories/OBSO-1403-01.pdf; http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx
CVE: CVE-2014-2651
Published: 2020-01-09
Description: Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx; https://networks.unify.com/security/advisories/OBSO-1403-02.pdf; http://assets.yourcircuit.com/Internet/web/Container%20Site/Misc/Footer-content/privacy-policy/security-advisories.aspx
CVE: CVE-2014-2686
Published: 2020-01-09
Description: Ansible prior to 1.5.4 mishandles the evaluation of some strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://groups.google.com/forum/#%21searchin/ansible-project/1.5.4/ansible-project/MUQxiKwSQDc/id6aVaawVboJ; https://groups.google.com/forum/#%21searchin/ansible-project/1.5.4/ansible-project/MUQxiKwSQDc/id6aVaawVboJ
CVE: CVE-2019-19494
Published: 2020-01-09
Description: Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel level via JavaScript run in a victim's browser. Examples of affected products include Sagemcom F@st 3890 prior to 50.10.21_T4, Sagemcom F@st 3890 prior to 05.76.6.3f, Sagemcom F@st 3686 3.428.0, Sagemcom F@st 3686 4.83.0, NETGEAR CG3700EMR 2.01.05, NETGEAR CG3700EMR 2.01.03, NETGEAR C6250EMR 2.01.05, NETGEAR C6250EMR 2.01.03, Technicolor TC7230 STEB 01.25, COMPAL 7284E 5.510.5.11, and COMPAL 7486E 5.510.5.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://cablehaunt.com; https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf; https://github.com/Lyrebirds/Fast8690-exploit
CVE: CVE-2020-5308
Published: 2020-01-09
Description: PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155861/Dairy-Farm-Shop-Management-System-1.0-Cross-Site-Scripting.html; https://cinzinga.github.io/CVE-2020-5307-5308/; https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
CVE: CVE-2014-3211
Published: 2020-01-09
Description: Publify before 8.0.1 is vulnerable to a Denial of Service attack
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://hackmysystems.tumblr.com/post/[PII_REDACTED]1/denial-of-service-in-publify-cve-2014-3211; https://hackmysystems.tumblr.com/post/[PII_REDACTED]1/denial-of-service-in-publify-cve-2014-3211
CVE: CVE-2014-3447
Published: 2020-01-09
Description: BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2014/May/86; https://packetstormsecurity.com/files/126741/BSS-Continuity-CMS-4.2.22640.0-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2014/May/86
CVE: CVE-2014-3448
Published: 2020-01-09
Description: BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/126740/BSS-Continuity-CMS-4.2.22640.0-Code-Execution.html; http://seclists.org/fulldisclosure/2014/May/85; http://packetstormsecurity.com/files/126740/BSS-Continuity-CMS-4.2.22640.0-Code-Execution.html
CVE: CVE-2014-3449
Published: 2020-01-09
Description: BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/126739/BSS-Continuity-CMS-4.2.22640.0-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2014/May/84; http://packetstormsecurity.com/files/126739/BSS-Continuity-CMS-4.2.22640.0-Authentication-Bypass.html
CVE: CVE-2014-3753
Published: 2020-01-09
Description: AgileBits 1Password through 1.0.9.340 allows security feature bypass
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18986; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18986
CVE: CVE-2018-18514
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-18515
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-18516
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2019-19332
Published: 2020-01-09
Description: An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19332
CVE: CVE-2019-11981
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11984. Reason: This candidate is a duplicate of CVE-2019-11984. Notes: All CVE users should reference CVE-2019-11984 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-20224
Published: 2020-01-09
Description: netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155897/Pandora-7.0NG-Remote-Code-Execution.html; https://drive.google.com/file/d/1DkWR5MylzeNr20jmHXTaAIJmf3YN-lnO/view?usp=sharing; https://gist.github.com/mhaskar/2153d66a0928492d76b799ba13b9e3f9
CVE: CVE-2019-14918
Published: 2020-01-09
Description: XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/InnotecSystem/Device-Reversing/wiki/XSS-Injection-via-DHCP-requests; https://github.com/InnotecSystem/Device-Reversing/wiki/XSS-Injection-via-DHCP-requests
CVE: CVE-2019-14919
Published: 2020-01-09
Description: An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials into a shell, gaining root execution privileges over the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://github.com/InnotecSystem/Device-Reversing/wiki/Firmware-Inspection; https://github.com/InnotecSystem/Device-Reversing/wiki/Firmware-Inspection
CVE: CVE-2019-14920
Published: 2020-01-09
Description: Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/system_command.asp shell feature.
CVSS Score: 8.8 (HIGH)
References: https://github.com/InnotecSystem/Device-Reversing/wiki/Firmware-Inspection; https://github.com/InnotecSystem/Device-Reversing/wiki/Firmware-Inspection
CVE: CVE-2019-4651
Published: 2020-01-09
Description: IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170962.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170962; https://www.ibm.com/support/pages/node/1169956; https://exchange.xforce.ibmcloud.com/vulnerabilities/170962
CVE: CVE-2020-1787
Published: 2020-01-09
Description: HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certain scenario, successful exploit could allow the attacker who gains the privilege of guest user to access to the host user's desktop in an instant, without unlocking the screen lock of the host user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-02-smartphone-en
CVE: CVE-2020-1826
Published: 2020-01-09
Description: Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to obtain some information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-phone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-phone-en
CVE: CVE-2018-12380
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-17009. Reason: This candidate is a duplicate of CVE-2019-17009. Notes: All CVE users should reference CVE-2019-17009 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-1786
Published: 2020-01-09
Description: HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. The software does not sufficiently validate the name of apk file in a special condition which could allow an attacker to forge a crafted application as a normal one. Successful exploit could allow the attacker to bypass digital balance function.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-smartphone-en
CVE: CVE-2020-1810
Published: 2020-01-09
Description: There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been considered as a weak algorithm. Attackers may exploit this vulnerability to leak some information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-rsa-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200108-01-rsa-en
CVE: CVE-2019-6320
Published: 2020-01-09
Description: Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial of service (DOS) or device misconfiguration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://support.hp.com/us-en/document/c06308143; https://support.hp.com/us-en/document/c06308143
CVE: CVE-2019-6330
Published: 2020-01-09
Description: A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. This vulnerability could potentially grant elevation of privilege.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hp.com/in-en/document/c06463137; https://support.hp.com/in-en/document/c06463137
CVE: CVE-2019-6331
Published: 2020-01-09
Description: An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.hp.com/in-en/document/c06424557; https://support.hp.com/in-en/document/c06424557
CVE: CVE-2019-6332
Published: 2020-01-09
Description: A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS). Affected products and versions include: HP DeskJet 2600 All-in-One Printer series model numbers 4UJ28B, V1N01A - V1N08A, Y5H60A - Y5H80A; HP DeskJet Ink Advantage 2600 All-in-One Printer series model numbers V1N02A - V1N02B, Y5Z00A - Y5Z04B; HP DeskJet Ink Advantage 5000 All-in-One Printer series model numbers M2U86A - M2U89B; HP DeskJet Ink Advantage 5200 All-in-One Printer series model numbers M2U76A - M2U78B; HP ENVY 5000 All-in-One Printer series model numbers M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A; HP ENVY Photo 6200 All-in-One Printer series model numbers K7G18A-K7G26B, K7S21B, Y0K13D - Y0K15A; HP ENVY Photo 7100 All-in-One Printer series model numbers 3XD89A, K7G93A-K7G99A, Z3M37A - Z3M52A; HP ENVY Photo 7800 All-in-One Printer series model numbers K7R96A, K7S00A - K7S10D, Y0G42D - Y0G52B; HP Ink Tank Wireless 410 series model numbers Z4B53A - Z4B55A, Z6Z95A - Z6Z99A, 4DX94A - 4DX95A, 4YF79A, Z7A01A; HP OfficeJet 5200 All-in-One Printer series model numbers M2U75A, M2U81A-M2U84B, Z4B12A - Z4B14A, Z4B27A - Z4B29A; HP Smart Tank Wireless 450 series model numbers Z4B56A, Z6Z96A - Z6Z98A.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.hp.com/in-en/document/c06428029; https://support.hp.com/in-en/document/c06428029
CVE: CVE-2020-1925
Published: 2020-01-09
Description: Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E; https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E
CVE: CVE-2020-6167
Published: 2020-01-09
Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers; https://wpvulndb.com/vulnerabilities/10007; https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE: CVE-2012-1258
Published: 2020-01-09
Description: cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote attackers to add user accounts with administrator privileges via the newuser, pwd, and selectedUserGroup parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/18750; http://www.securityfocus.com/bid/52989
CVE: CVE-2012-1259
Published: 2020-01-09
Description: Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allow remote attackers to execute arbitrary SQL commands via the (1) addip parameter to cgi-bin/scrut_fa_exclusions.cgi, (2) getPermissionsAndPreferences parameter to cgi-bin/login.cgi, or (3) possibly certain parameters to d4d/alarms.php as demonstrated by the search_str parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/18750; http://www.securityfocus.com/bid/52989
CVE: CVE-2012-1260
Published: 2020-01-09
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allows remote attackers to inject arbitrary web script or HTML via the newUser parameter. NOTE: this might not be a vulnerability, since an administrator might already have the privileges to create arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/18750; http://www.securityfocus.com/bid/52989
CVE: CVE-2012-1261
Published: 2020-01-09
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/111791/Scrutinizer-8.6.2-Bypass-Cross-Site-Scripting-SQL-Injection.html; http://www.exploit-db.com/exploits/18750; http://www.securityfocus.com/bid/52989