deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20782
Published: 2019-02-17
Description: The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/GloBee-Official/woocommerce-payment-api-plugin/issues/3; https://github.com/GloBee-Official/woocommerce-payment-api-plugin/pull/2; https://www.exploit-db.com/exploits/46414/
CVE: CVE-2019-8407
Published: 2019-02-17
Description: HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Neeke/HongCMS/issues/7; https://github.com/Neeke/HongCMS/issues/7
CVE: CVE-2019-8408
Published: 2019-02-17
Description: OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice.
CVSS Score: 4.9 (MEDIUM)
References: https://github.com/Self-Evident/OneFileCMS/issues/51; https://github.com/Self-Evident/OneFileCMS/issues/51
CVE: CVE-2019-8411
Published: 2019-02-17
Description: admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/615/VulnPoC/issues/1; https://github.com/615/VulnPoC/issues/1
CVE: CVE-2019-8412
Published: 2019-02-17
Description: FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-id-..\ directory traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/615/cms_vuln/blob/master/feifei.docx; https://github.com/615/cms_vuln/blob/master/feifei.docx
CVE: CVE-2019-8413
Published: 2019-02-17
Description: On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 (aka decimal[PII_REDACTED]).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/datadancer/HIAFuzz/blob/master/MIX2_elliptic.md; https://github.com/datadancer/HIAFuzz/blob/master/MIX2_elliptic.md
CVE: CVE-2019-7649
Published: 2019-02-17
Description: global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://github.com/arterli/CmsWing/issues/41; https://github.com/arterli/CmsWing/issues/41
CVE: CVE-2019-8418
Published: 2019-02-17
Description: SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
CVSS Score: 8.8 (HIGH)
References: https://github.com/seacms/seacms-v7.2/issues/2; https://github.com/seacms/seacms-v7.2/issues/2
CVE: CVE-2019-8419
Published: 2019-02-17
Description: VNote 2.2 has XSS via a new text note.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tamlok/vnote/issues/564; https://github.com/tamlok/vnote/issues/564
CVE: CVE-2019-8421
Published: 2019-02-17
Description: upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/bagesoft/bagecms/issues/5; https://github.com/bagesoft/bagecms/issues/5
CVE: CVE-2019-8422
Published: 2019-02-17
Description: A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/wowwooo/vnotes/blob/master/PbootCMS%20SQL%20Injection%20Description.md; https://github.com/wowwooo/vnotes/blob/master/PbootCMS%20SQL%20Injection%20Description.md
CVE: CVE-2019-8423
Published: 2019-02-18
Description: ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewseventsphp-line-44-sql-injection; https://www.seebug.org/vuldb/ssvid-97761; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewseventsphp-line-44-sql-injection
CVE: CVE-2019-8424
Published: 2019-02-18
Description: ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-276-orderby-sql-injection; https://www.seebug.org/vuldb/ssvid-97763; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-276-orderby-sql-injection
CVE: CVE-2019-8425
Published: 2019-02-18
Description: includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#sql-query-error-reflected-xss; https://www.seebug.org/vuldb/ssvid-97764; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#sql-query-error-reflected-xss
CVE: CVE-2019-8426
Published: 2019-02-18
Description: skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolcapphp-reflected-xss; https://www.seebug.org/vuldb/ssvid-97766; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolcapphp-reflected-xss
CVE: CVE-2019-8427
Published: 2019-02-18
Description: daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#includesfunctionsphp-daemoncontrol-command-injection; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#includesfunctionsphp-daemoncontrol-command-injection
CVE: CVE-2019-8428
Published: 2019-02-18
Description: ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolphp-line-35-second-order-sqli; https://www.seebug.org/vuldb/ssvid-97765; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolphp-line-35-second-order-sqli
CVE: CVE-2019-8429
Published: 2019-02-18
Description: ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-393-sql-injection; https://www.seebug.org/vuldb/ssvid-97762; https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-393-sql-injection
CVE: CVE-2019-8432
Published: 2019-02-18
Description: In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fakerrr/CmsEasy_7.0/issues/1; https://github.com/fakerrr/CmsEasy_7.0/issues/1
CVE: CVE-2019-8433
Published: 2019-02-18
Description: JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/jetiben/jtbc/issues/6; https://github.com/jetiben/jtbc/issues/6
CVE: CVE-2019-8434
Published: 2019-02-18
Description: In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fakerrr/CmsEasy_7.0/issues/2; https://github.com/fakerrr/CmsEasy_7.0/issues/2
CVE: CVE-2019-8435
Published: 2019-02-18
Description: admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/gaozhifeng/PHPMyWind/issues/3; https://github.com/gaozhifeng/PHPMyWind/issues/3
CVE: CVE-2019-8436
Published: 2019-02-18
Description: imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/peacexie/imcat/issues/1; https://github.com/peacexie/imcat/issues/1
CVE: CVE-2019-8902
Published: 2019-02-18
Description: An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://github.com/idreamsoft/iCMS/issues/56; https://github.com/idreamsoft/iCMS/issues/56
CVE: CVE-2019-6453
Published: 2019-02-18
Description: mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/proofofcalc/cve-2019-6453-poc; https://proofofcalc.com/advisories/20190218.txt; https://proofofcalc.com/cve-2019-6453-mIRC/
CVE: CVE-2019-8372
Published: 2019-02-18
Description: The LHA.sys driver before 1.1.1811.2101 in LG Device Manager exposes functionality that allows low-privileged users to read and write arbitrary physical memory via specially crafted IOCTL requests and elevate system privileges. This occurs because the device object has an associated symbolic link and an open DACL.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: http://www.jackson-t.ca/lg-driver-lpe.html; https://lgsecurity.lge.com/security_updates.html; https://twitter.com/Jackson_T/status/[PII_REDACTED]34475009
CVE: CVE-2019-8903
Published: 2019-02-18
Description: index.js in Total.js Platform before 3.2.3 allows path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903; https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7; https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
CVE: CVE-2018-12159
Published: 2019-02-18
Description: Buffer overflow in the command-line interface for Intel(R) PROSet Wireless v20.50 and before may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00169.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00169.html
CVE: CVE-2018-3700
Published: 2019-02-18
Description: Code injection vulnerability in the installer for Intel(R) USB 3.0 eXtensible Host Controller Driver for Microsoft Windows 7 before version 5.0.4.43v2 may allow a user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/107073; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00200.html; http://www.securityfocus.com/bid/107073
CVE: CVE-2019-0101
Published: 2019-02-18
Description: Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege to the Intel Unite(R) Solution administrative portal via network access.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/107076; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00214.html; http://www.securityfocus.com/bid/107076
CVE: CVE-2019-0102
Published: 2019-02-18
Description: Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html; http://www.securityfocus.com/bid/107069; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01
CVE: CVE-2019-0103
Published: 2019-02-18
Description: Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107074; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0104
Published: 2019-02-18
Description: Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107109; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0105
Published: 2019-02-18
Description: Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/107069; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0106
Published: 2019-02-18
Description: Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
References: http://www.securityfocus.com/bid/107069; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0107
Published: 2019-02-18
Description: Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
References: http://www.securityfocus.com/bid/107069; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0108
Published: 2019-02-18
Description: Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/107075; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0109
Published: 2019-02-18
Description: Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/107069; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0110
Published: 2019-02-18
Description: Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107071; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0111
Published: 2019-02-18
Description: Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/107067; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0112
Published: 2019-02-18
Description: Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable a denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
References: http://www.securityfocus.com/bid/107064; https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html
CVE: CVE-2019-0127
Published: 2019-02-18
Description: Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 3.9 (LOW)
References: http://www.securityfocus.com/bid/107110; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00222.html; http://www.securityfocus.com/bid/107110
CVE: CVE-2019-8904
Published: 2019-02-18
Description: do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/107130; https://bugs.astron.com/view.php?id=62; https://usn.ubuntu.com/3911-1/
CVE: CVE-2019-8905
Published: 2019-02-18
Description: do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html; http://www.securityfocus.com/bid/107137
CVE: CVE-2019-8906
Published: 2019-02-18
Description: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html; https://bugs.astron.com/view.php?id=64
CVE: CVE-2019-8907
Published: 2019-02-18
Description: do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html; https://bugs.astron.com/view.php?id=65
CVE: CVE-2019-8908
Published: 2019-02-18
Description: An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-706
References: https://github.com/taosir/wtcms/issues/3; https://github.com/taosir/wtcms/issues/3
CVE: CVE-2019-8909
Published: 2019-02-18
Description: An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/taosir/wtcms/issues/6; https://github.com/taosir/wtcms/issues/6
CVE: CVE-2019-8910
Published: 2019-02-18
Description: An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/taosir/wtcms/issues/5; https://github.com/taosir/wtcms/issues/5
CVE: CVE-2019-8911
Published: 2019-02-18
Description: An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/taosir/wtcms/issues/5; https://github.com/taosir/wtcms/issues/5
CVE: CVE-2019-8912
Published: 2019-02-18
Description: In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html; http://patchwork.ozlabs.org/patch/1042902/; http://www.securityfocus.com/bid/107063
CVE: CVE-2019-8917
Published: 2019-02-18
Description: SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/107061; https://github.com/VerSprite/research/blob/master/advisories/VS-2019-001.md; http://www.securityfocus.com/bid/107061
CVE: CVE-2019-7629
Published: 2019-02-18
Description: Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://tintin.sourceforge.io/forum/viewtopic.php?f=1&t=2584&sid=31b77bb001faea9269bf224280960e29#p10505; https://tintin.sourceforge.io/news.php; https://trustfoundry.net/cve-2019-7629-rce-in-an-open-source-mud-client/
CVE: CVE-2019-8919
Published: 2019-02-18
Description: The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://github.com/haiwen/seadroid/issues/789; https://github.com/haiwen/seadroid/issues/789
CVE: CVE-2019-8933
Published: 2019-02-19
Description: In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://blog.csdn.net/qq_36093477/article/details/86681178; https://blog.csdn.net/qq_36093477/article/details/86681178
CVE: CVE-2019-3812
Published: 2019-02-19
Description: QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00040.html; http://www.securityfocus.com/bid/107059
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  This CVE id is an example number in https://cve.mitre.org/cve/identifiers/syntaxchange.html. Notes: none