deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0255
Published: 2019-02-15
Description: SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106987; https://launchpad.support.sap.com/#/notes/2723570; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0256
Published: 2019-02-15
Description: Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106995; https://launchpad.support.sap.com/#/notes/2723878; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0257
Published: 2019-02-15
Description: Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/106999; https://launchpad.support.sap.com/#/notes/2728839; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0258
Published: 2019-02-15
Description: SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/106969; https://launchpad.support.sap.com/#/notes/2724014; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0259
Published: 2019-02-15
Description: SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/106997; https://launchpad.support.sap.com/#/notes/2727564; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0261
Published: 2019-02-15
Description: Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/106986; https://launchpad.support.sap.com/#/notes/2742027; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0262
Published: 2019-02-15
Description: SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106998; https://launchpad.support.sap.com/#/notes/2696714; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0265
Published: 2019-02-15
Description: SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/106972; http://www.securityfocus.com/bid/107364; https://launchpad.support.sap.com/#/notes/2729710
CVE: CVE-2019-0266
Published: 2019-02-15
Description: Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/106988; https://launchpad.support.sap.com/#/notes/2724713; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2019-0267
Published: 2019-02-15
Description: SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/106990; https://launchpad.support.sap.com/#/notes/2686535; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
CVE: CVE-2017-1695
Published: 2019-02-15
Description: IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 134177.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.securityfocus.com/bid/107060; https://exchange.xforce.ibmcloud.com/vulnerabilities/134177; https://www.ibm.com/support/docview.wss?uid=ibm10719107
CVE: CVE-2018-1701
Published: 2019-02-15
Description: IBM InfoSphere Information Server 11.7 could allow an authenciated user under specialized conditions to inject commands into the installation process that would execute on the WebSphere Application Server. IBM X-Force ID: 145970.
CVSS Score: 8.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/145970; https://www.ibm.com/support/docview.wss?uid=ibm10730555; https://exchange.xforce.ibmcloud.com/vulnerabilities/145970
CVE: CVE-2018-1727
Published: 2019-02-15
Description: IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147630.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/147630; https://www.ibm.com/support/docview.wss?uid=ibm10718887; https://exchange.xforce.ibmcloud.com/vulnerabilities/147630
CVE: CVE-2018-1895
Published: 2019-02-15
Description: IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152159.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10744013; https://exchange.xforce.ibmcloud.com/vulnerabilities/152159; http://www.ibm.com/support/docview.wss?uid=ibm10744013
CVE: CVE-2019-4059
Published: 2019-02-15
Description: IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. An attacker could obtain the password and gain unauthorized access to the document database. IBM X-Force ID: 156583.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156583; https://www.ibm.com/support/docview.wss?uid=ibm10870810; https://exchange.xforce.ibmcloud.com/vulnerabilities/156583
CVE: CVE-2013-2516
Published: 2019-02-15
Description: Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://rubygems.org/gems/fileutils; http://www.vapidlabs.com/advisory.php?v=36; http://rubygems.org/gems/fileutils
CVE: CVE-2013-2565
Published: 2019-02-15
Description: A vulnerability in Mambo CMS v4.6.5 where the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://sourceforge.net/projects/mambo/; http://www.vapidlabs.com/advisory.php?v=75; http://sourceforge.net/projects/mambo/
CVE: CVE-2013-5654
Published: 2019-02-15
Description: Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744; http://www.vapidlabs.com/advisory.php?v=94; http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744
CVE: CVE-2015-4615
Published: 2019-02-15
Description: Vulnerability in Easy2map-photos WordPress Plugin v1.09 allows SQL Injection via unsanitized mapTemplateName, mapName, mapSettingsXML, parentCSSXML, photoCSSXML, mapCSSXML, mapHTML,mapID variables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.vapid.dhs.org/advisory.php?v=130; https://wordpress.org/plugins/easy2map-photos; http://www.vapid.dhs.org/advisory.php?v=130
CVE: CVE-2015-4617
Published: 2019-02-15
Description: Vulnerability in Easy2map-photos WordPress Plugin v1.09 MapPinImageUpload.php and MapPinIconSave.php allows path traversal when specifying file names creating files outside of the upload directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.vapidlabs.com/advisory.php?v=130; https://wordpress.org/plugins/easy2map-photos; http://www.vapidlabs.com/advisory.php?v=130
CVE: CVE-2019-8354
Published: 2019-02-15
Description: An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html; https://sourceforge.net/p/sox/bugs/319; https://usn.ubuntu.com/4079-1/
CVE: CVE-2019-8355
Published: 2019-02-15
Description: An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html; https://sourceforge.net/p/sox/bugs/320; https://usn.ubuntu.com/4079-1/
CVE: CVE-2019-8356
Published: 2019-02-15
Description: An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-129, CWE-787
References: https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html; https://sourceforge.net/p/sox/bugs/321; https://usn.ubuntu.com/4079-1/
CVE: CVE-2019-8357
Published: 2019-02-15
Description: An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://lists.debian.org/debian-lts-announce/2019/05/msg00040.html; https://sourceforge.net/p/sox/bugs/318; https://usn.ubuntu.com/4079-1/
CVE: CVE-2019-8358
Published: 2019-02-16
Description: In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.hiawatha-webserver.org/changelog; https://www.hiawatha-webserver.org/changelog
CVE: CVE-2019-8360
Published: 2019-02-16
Description: Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/151706/Find-A-Place-CMS-Directory-1.5-SQL-Injection.html; https://packetstormsecurity.com/files/151706/Find-A-Place-CMS-Directory-1.5-SQL-Injection.html
CVE: CVE-2019-8361
Published: 2019-02-16
Description: PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackingvila.wordpress.com/2019/02/16/url-redirection-through-html-injection-in-responsive-video-news-script-php-script-mall/; https://hackingvila.wordpress.com/2019/02/16/xss-vulnerability-in-responsive-video-news-script-php-script-mall/; https://hackingvila.wordpress.com/2019/02/16/url-redirection-through-html-injection-in-responsive-video-news-script-php-script-mall/
CVE: CVE-2019-8362
Published: 2019-02-16
Description: DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, or .gif is present as a substring, and does not otherwise check the file name or content).
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://tusk1.cn/2019/02/16/dedecms%20v5.7%20sp2%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/; http://tusk1.cn/2019/02/16/dedecms%20v5.7%20sp2%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/
CVE: CVE-2019-8363
Published: 2019-02-16
Description: Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Verytops/verydows/issues/12; https://github.com/Verytops/verydows/issues/12
CVE: CVE-2019-8376
Published: 2019-02-17
Description: An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/107085; https://github.com/appneta/tcpreplay/issues/537; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
CVE: CVE-2019-8377
Published: 2019-02-17
Description: An issue was discovered in Tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/107085; https://github.com/appneta/tcpreplay/issues/536; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/
CVE: CVE-2019-8378
Published: 2019-02-17
Description: An issue was discovered in Bento4 1.5.1-628. A heap-based buffer over-read exists in AP4_BitStream::ReadBytes() in Codecs/Ap4BitStream.cpp, a similar issue to CVE-2017-14645. It can be triggered by sending a crafted file to the aac2mp4 binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/363; https://research.loginsoft.com/bugs/a-heap-buffer-overflow-vulnerability-in-the-function-ap4_bitstreamreadbytes-bento4-1-5-1-628/; https://github.com/axiomatic-systems/Bento4/issues/363
CVE: CVE-2019-8379
Published: 2019-02-17
Description: An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2332; https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/
CVE: CVE-2019-8380
Published: 2019-02-17
Description: An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in AP4_Track::GetSampleIndexForTimeStampMs() located in Core/Ap4Track.cpp. It can triggered by sending a crafted file to the mp4audioclip binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/366; https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-ap4_trackgetsampleindexfortimestampms-bento4-1-5-1-628/; https://github.com/axiomatic-systems/Bento4/issues/366
CVE: CVE-2019-8381
Published: 2019-02-17
Description: An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/appneta/tcpreplay/issues/538; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EB3ASS7URTIA3IFSBL2DIWJAFKTBJCAW/
CVE: CVE-2019-8382
Published: 2019-02-17
Description: An issue was discovered in Bento4 1.5.1-628. A NULL pointer dereference occurs in the function AP4_List:Find located in Core/Ap4List.h when called from Core/Ap4Movie.cpp. It can be triggered by sending a crafted file to the mp4dump binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/364; https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-ap4_listfind-bento4-1-5-1-628/; https://github.com/axiomatic-systems/Bento4/issues/364
CVE: CVE-2019-8383
Published: 2019-02-17
Description: An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:2332; https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/
CVE: CVE-2019-8389
Published: 2019-02-17
Description: A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder (with a crafted ../ payload) to the download.script endpoint. This will create a MusicPlayerArchive.zip archive that is publicly accessible and includes the content of any requested file (such as the /etc/passwd file).
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://gist.github.com/shawarkhanethicalhacker/b98c5ac7491cf77732c793ecc468f465; https://gist.github.com/shawarkhanethicalhacker/b98c5ac7491cf77732c793ecc468f465
CVE: CVE-2019-7399
Published: 2019-02-17
Description: Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.
CVSS Score: 7.4 (HIGH)
CWE: CWE-346
References: http://www.securityfocus.com/bid/107025; https://wwws.nightwatchcybersecurity.com/2019/02/07/content-injection-in-amazon-kindles-fireos-cve-2019-7399/; http://www.securityfocus.com/bid/107025
CVE: CVE-2019-8392
Published: 2019-02-17
Description: An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead.
CVSS Score: 7.5 (HIGH)
References: https://github.com/leonW7/D-Link/blob/master/Vul_6.md; https://github.com/leonW7/D-Link/blob/master/Vul_6.md
CVE: CVE-2019-8394
Published: 2019-02-17
Description: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/107129; https://www.exploit-db.com/exploits/46413/; https://www.manageengine.com/products/service-desk/readme.html
CVE: CVE-2019-8395
Published: 2019-02-17
Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-706
References: https://www.manageengine.com/products/service-desk/readme.html; https://www.manageengine.com/products/service-desk/readme.html
CVE: CVE-2019-8396
Published: 2019-02-17
Description: A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/magicSwordsMan/PAAFS/tree/master/vul4; https://github.com/magicSwordsMan/PAAFS/tree/master/vul4
CVE: CVE-2019-8397
Published: 2019-02-17
Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/magicSwordsMan/PAAFS/tree/master/vul5; https://github.com/magicSwordsMan/PAAFS/tree/master/vul5
CVE: CVE-2019-8398
Published: 2019-02-17
Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/magicSwordsMan/PAAFS/tree/master/vul6; https://github.com/magicSwordsMan/PAAFS/tree/master/vul6
CVE: CVE-2019-8400
Published: 2019-02-17
Description: ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk; https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06; https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3
CVE: CVE-2019-8393
Published: 2019-02-17
Description: Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FantasticLBP/Hotels_Server/issues/4; https://github.com/FantasticLBP/Hotels_Server/issues/4
CVE: CVE-2016-10742
Published: 2019-02-17
Description: Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://lists.debian.org/debian-lts-announce/2019/03/msg00010.html; https://lists.debian.org/debian-lts-announce/2020/11/msg00039.html; https://support.zabbix.com/browse/ZBX-10272