deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5819
Published: 2019-02-20
Description: An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/; https://usn.ubuntu.com/3989-1/
CVE: CVE-2019-3924
Published: 2019-02-20
Description: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router's firewall or for general network scanning activities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-441, CWE-441
References: http://www.securityfocus.com/bid/107177; https://www.exploit-db.com/exploits/46444/; https://www.tenable.com/security/research/tra-2019-07
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-20
Description: A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/107295; https://access.redhat.com/errata/RHSA-2019:0739; https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-20
Description: A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/107295; https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876; http://www.securityfocus.com/bid/107295
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-20
Description: A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/107295; https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985; http://www.securityfocus.com/bid/107295
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-20
Description: A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/107295; https://jenkins.io/security/advisory/2019-02-19/#SECURITY-817; http://www.securityfocus.com/bid/107295
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-20
Description: A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: http://www.securityfocus.com/bid/107295; https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033; http://www.securityfocus.com/bid/107295
CVE: CVE-2019-3474
Published: 2019-02-20
Description: A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://download.novell.com/Download?buildid=nZUCSDkvpxk~; https://support.microfocus.com/kb/doc.php?id=7023726; https://www.exploit-db.com/exploits/46450/
CVE: CVE-2019-3475
Published: 2019-02-20
Description: A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-269
References: https://download.novell.com/Download?buildid=nZUCSDkvpxk~; https://support.microfocus.com/kb/doc.php?id=7023727; https://www.exploit-db.com/exploits/46450/
CVE: CVE-2018-15380
Published: 2019-02-20
Description: A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster service manager and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affected host as the root user. This vulnerability affects Cisco HyperFlex Software releases prior to 3.5(2a).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/107095; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyperflex-injection; http://www.securityfocus.com/bid/107095
CVE: CVE-2019-5727
Published: 2019-02-21
Description: Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107113; https://www.splunk.com/view/SP-CAAAQAF; http://www.securityfocus.com/bid/107113
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2019-7580.  Reason: This candidate is a reservation duplicate of CVE-2019-7580.  Notes: All CVE users should reference CVE-2019-7580 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2019-7575, CVE-2019-7577.  Reason: This candidate is a reservation duplicate of CVE-2019-7575 and/or CVE-2019-7577.  Notes: All CVE users should reference CVE-2019-7575 and/or CVE-2019-7577 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-7469.  Reason: This candidate is a reservation duplicate of CVE-2013-7469.  Notes: All CVE users should reference CVE-2013-7469 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2019-8363.  Reason: This candidate is a reservation duplicate of CVE-2019-8363.  Notes: All CVE users should reference CVE-2019-8363 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-7469
Published: 2019-02-21
Description: Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://drive.google.com/file/d/1rwYsnuhZZxmSR6Zs8rJlWW3R27XBOSJU/view; https://github.com/haiwen/seafile/issues/350; https://drive.google.com/file/d/1rwYsnuhZZxmSR6Zs8rJlWW3R27XBOSJU/view
CVE: CVE-2018-20146
Published: 2019-02-21
Description: An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVSS Score: 7.8 (HIGH)
References: https://www.liquidware.com/content/pdf/documents/support/Liquidware-ProfileUnity-Release-Notes.pdf; https://www.liquidware.com/content/pdf/documents/support/Liquidware-ProfileUnity-Release-Notes.pdf
CVE: CVE-2019-8979
Published: 2019-02-21
Description: Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/huzr2018/orderby_SQLi; https://github.com/huzr2018/orderby_SQLi
CVE: CVE-2019-8980
Published: 2019-02-21
Description: A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html; http://www.securityfocus.com/bid/107120; https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
CVE: CVE-2018-20122
Published: 2019-02-21
Description: The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vulnerable to a command injection vulnerability that can be exploited to achieve remote code execution with root privileges. No authentication is required in order to trigger the vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.horizonsecurity.it/advisories/?a=12&title=Fastweb+FastGate+router+101b+Remote+code+execution++CVE201820122; http://www.horizonsecurity.it/advisories/?a=12&title=Fastweb+FastGate+router+101b+Remote+code+execution++CVE201820122
CVE: CVE-2018-6687
Published: 2019-02-21
Description: Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/107126; https://kc.mcafee.com/corporate/index?page=content&id=SB10270; http://www.securityfocus.com/bid/107126
CVE: CVE-2019-8982
Published: 2019-02-21
Description: com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-918
References: https://www.exploit-db.com/exploits/45158; https://www.exploit-db.com/exploits/45158
CVE: CVE-2019-1659
Published: 2019-02-21
Description: A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. An attacker could exploit this vulnerability by using a crafted SSL certificate and could then intercept communications between the ISE and PI. A successful exploit could allow the attacker to view and alter potentially sensitive information that the ISE maintains about clients that are connected to the network. This vulnerability affects Cisco Prime Infrastructure Software Releases 2.2 through 3.4.0 when the PI server is integrated with ISE, which is disabled by default.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/107092; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-prime-validation; http://www.securityfocus.com/bid/107092
CVE: CVE-2019-8983
Published: 2019-02-21
Description: MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/; https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
CVE: CVE-2019-8984
Published: 2019-02-21
Description: MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/; https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
CVE: CVE-2018-1944
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153386; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153386
CVE: CVE-2018-1945
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153387; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153387
CVE: CVE-2018-1946
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153388; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153388
CVE: CVE-2018-1947
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153427; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153427
CVE: CVE-2018-1948
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153428; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153428
CVE: CVE-2018-1949
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153429; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153429
CVE: CVE-2018-1950
Published: 2019-02-21
Description: IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153430; https://www.ibm.com/support/docview.wss?uid=ibm10872142; https://exchange.xforce.ibmcloud.com/vulnerabilities/153430
CVE: CVE-2018-2006
Published: 2019-02-21
Description: IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to upload arbitrary files to the system. IBM X-Force ID: 155008.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/107122; https://exchange.xforce.ibmcloud.com/vulnerabilities/155008; https://www.ibm.com/support/docview.wss?uid=ibm10794133
CVE: CVE-2019-1662
Published: 2019-02-21
Description: A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the QOVR service with a valid username. A successful exploit could allow the attacker to perform actions with the privileges of the user that is used for access. This vulnerability affects Cisco PCA Software Releases prior to 12.1 SP2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/107096; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-pca-access; http://www.securityfocus.com/bid/107096
CVE: CVE-2018-20783
Published: 2019-02-21
Description: In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
CVE: CVE-2019-1664
Published: 2019-02-21
Description: A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-287
References: http://www.securityfocus.com/bid/107103; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-chn-root-access; http://www.securityfocus.com/bid/107103
CVE: CVE-2019-1665
Published: 2019-02-21
Description: A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Versions prior to 3.5(1a) are affected.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107097; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-xss; http://www.securityfocus.com/bid/107097
CVE: CVE-2019-1666
Published: 2019-02-21
Description: A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-287
References: http://www.securityfocus.com/bid/107108; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-retrieve; http://www.securityfocus.com/bid/107108
CVE: CVE-2019-1667
Published: 2019-02-21
Description: A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface. Versions prior to 3.5(2a) are affected.
CVSS Score: 3.3 (LOW)
CWE: CWE-345, CWE-863
References: http://www.securityfocus.com/bid/107100; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-write; http://www.securityfocus.com/bid/107100
CVE: CVE-2019-8985
Published: 2019-02-21
Description: On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-787
References: https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/netis/buffer%20overflow.md; https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/netis/buffer%20overflow.md