deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6760
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7694.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-434/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6761
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA CXFA_FFDocView object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7777.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-435/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6762
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7844.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-436/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6763
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ToggleFormsDesign method of the Foxit.FoxitReader.Ctl ActiveX object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7874.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-437/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6764
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA Template objects. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7972.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-438/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6765
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8170.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-439/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6766
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8162.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-440/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6767
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8163.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-441/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6768
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8164.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-442/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6769
Published: 2019-06-03
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8165.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-443/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6770
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8229.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-444/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6771
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2[PII_REDACTED]8. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the value property of a Field object within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8230.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-445/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6772
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 2[PII_REDACTED]8. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8231.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-446/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6773
Published: 2019-06-03
Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the richValue property of a Field object within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8272.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-447/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-9753
Published: 2019-06-03
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the search result screens to disclose information from invalid system entities. Following is the list of affected entities: Custom Pages, FAQ Articles, Service Catalogue Items, ITSM Configuration Items.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://community.otrs.com/security-advisory-2019-03-security-update-for-otrs-framework; https://community.otrs.com/security-advisory-2019-03-security-update-for-otrs-framework
CVE: CVE-2013-1752
Published: 2019-06-03
Description: Rejected reason: Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions
CVE: CVE-2017-14854
Published: 2019-06-03
Description: A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects all versions prior to 2017-09-25.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.orpak.com; http://www.securityfocus.com/bid/108167; https://ics-cert.us-cert.gov/advisories/ICSA-19-122-01
CVE: CVE-2019-11356
Published: 2019-06-03
Description: The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2019:1771; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGO43JS7IFDNITHXOOHOP6JHRKRDIYY6/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PICSZDC3UGEUZ27VXGGM6OFI67D3KKLZ/
CVE: CVE-2019-11369
Published: 2019-06-03
Description: An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://seclists.org/fulldisclosure/2019/Oct/45; https://drive.google.com/open?id=12Sq6oaxe1mC1y71Emo1YladjDjwTdNfb; https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11369
CVE: CVE-2019-11370
Published: 2019-06-03
Description: Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/open?id=1WkmtsCVNCtxwWH2fe9DtHow_Nedp1a7j; https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11370; https://drive.google.com/open?id=1WkmtsCVNCtxwWH2fe9DtHow_Nedp1a7j
CVE: CVE-2019-11509
Published: 2019-06-03
Description: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.
CVSS Score: 8.8 (HIGH)
References: https://kb.pulsesecure.net/?atype=sa; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/; https://www.kb.cert.org/vuls/id/927237
CVE: CVE-2019-12169
Published: 2019-06-03
Description: ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/; http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Execution.html; http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-Execution.html
CVE: CVE-2019-12176
Published: 2019-06-03
Description: Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges to SYSTEM via reconfiguration of either service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://community.viveport.com/; https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8; https://community.viveport.com/
CVE: CVE-2019-12177
Published: 2019-06-03
Description: Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges via DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://community.viveport.com/; https://huskersec.com/privilege-escalation-via-htc-viveport-desktop-c93471ff87c8; https://posts.specterops.io/razer-synapse-3-elevation-of-privilege-6d2802bd0585
CVE: CVE-2019-12373
Published: 2019-06-03
Description: Improper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote disclosure of administrator passwords.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732
References: https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-administrator-password-disclosure/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-administrator-password-disclosure/
CVE: CVE-2019-12374
Published: 2019-06-03
Description: A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to improper username sanitization in the Basic Authentication implementation in core/provisioning.secure/ProvisioningSecure.asmx in Provisioning.Secure.dll.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-sql-injection/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/
CVE: CVE-2019-12375
Published: 2019-06-03
Description: Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information disclosure and arbitrary code execution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-552
References: https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-open-directories/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-open-directories/
CVE: CVE-2019-12376
Published: 2019-06-03
Description: Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoint compromise by an authenticated user with read privileges.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-798
References: https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-hard-coded-encryption-key/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-hard-coded-encryption-key/
CVE: CVE-2019-12377
Published: 2019-06-03
Description: A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-arbitrary-file-upload/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-multiple-vulnerabilities/; https://www.gnzlabs.io/gnzlabs-blog/landesk-management-server-arbitrary-file-upload/
CVE: CVE-2019-6588
Published: 2019-06-03
Description: In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3; http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html
CVE: CVE-2019-10009
Published: 2019-06-03
Description: A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/152244/Titan-FTP-Server-2019-Build-3505-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/Mar/47; http://www.southrivertech.com/software/regsoft/titanftp/v19/verhist_en.html
CVE: CVE-2019-10883
Published: 2019-06-03
Description: Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://support.citrix.com/article/CTX247737; https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin; https://www.tenable.com/security/research
CVE: CVE-2019-11185
Published: 2019-06-03
Description: The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://wordpress.org/plugins/wp-live-chat-support/#developers; https://wp-livechat.com/; https://wpvulndb.com/vulnerabilities/9320
CVE: CVE-2019-11367
Published: 2019-06-03
Description: An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311, CWE-522
References: http://packetstormsecurity.com/files/153151/AUO-Solar-Data-Recorder-Incorrect-Access-Control.html; https://drive.google.com/file/d/1H1L5s14Omnx1eJAdRlRninnqUKLJ_xDA/view; https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11367