deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15666
Published: 2019-08-27
Description: An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19
CVE: CVE-2014-10395
Published: 2019-08-27
Description: The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cp-polls/#developers; https://wordpress.org/plugins/cp-polls/#developers
CVE: CVE-2015-9342
Published: 2019-08-27
Description: The wp-rollback plugin before 1.2.3 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-rollback/#developers; https://wordpress.org/plugins/wp-rollback/#developers
CVE: CVE-2015-9343
Published: 2019-08-27
Description: The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-rollback/#developers; https://wordpress.org/plugins/wp-rollback/#developers
CVE: CVE-2015-9344
Published: 2019-08-27
Description: The link-log plugin before 2.1 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/link-log/#developers; https://wordpress.org/plugins/link-log/#developers
CVE: CVE-2015-9345
Published: 2019-08-27
Description: The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://wordpress.org/plugins/link-log/#developers; https://wordpress.org/plugins/link-log/#developers
CVE: CVE-2015-9346
Published: 2019-08-27
Description: The cp-polls plugin before 1.0.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cp-polls/#developers; https://wordpress.org/plugins/cp-polls/#developers
CVE: CVE-2015-9347
Published: 2019-08-27
Description: The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-plotly/#developers; https://wordpress.org/plugins/wp-plotly/#developers
CVE: CVE-2015-9349
Published: 2019-08-27
Description: The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ckeditor-for-wordpress/#developers; https://wordpress.org/plugins/ckeditor-for-wordpress/#developers
CVE: CVE-2016-10934
Published: 2019-08-27
Description: The check-email plugin before 0.5.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/check-email/#developers; https://wordpress.org/plugins/check-email/#developers
CVE: CVE-2016-10935
Published: 2019-08-27
Description: The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://wordpress.org/plugins/woocommerce-exporter/#developers; https://wpvulndb.com/vulnerabilities/9825; https://wordpress.org/plugins/woocommerce-exporter/#developers
CVE: CVE-2017-18590
Published: 2019-08-27
Description: The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/timesheet/#developers; https://wordpress.org/plugins/timesheet/#developers
CVE: CVE-2018-17557
Published: 2019-08-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-20986. Reason: This candidate is a reservation duplicate of CVE-2018-20986. Notes: All CVE users should reference CVE-2018-20986 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-21001
Published: 2019-08-27
Description: The anycomment plugin before 0.0.33 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/anycomment/#developers; https://wordpress.org/plugins/anycomment/#developers
CVE: CVE-2018-21002
Published: 2019-08-27
Description: The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/js-support-ticket/#developers; https://wordpress.org/plugins/js-support-ticket/#developers
CVE: CVE-2018-21003
Published: 2019-08-27
Description: The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/buddyforms/#developers; https://wpvulndb.com/vulnerabilities/9829; https://wordpress.org/plugins/buddyforms/#developers
CVE: CVE-2018-21004
Published: 2019-08-27
Description: The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/log/rsvpmaker/tags/5.6.4; https://wordpress.org/plugins/rsvpmaker/#developers; https://wpvulndb.com/vulnerabilities/9831
CVE: CVE-2018-21005
Published: 2019-08-27
Description: The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://wordpress.org/plugins/bbp-move-topics/#developers; https://wordpress.org/plugins/bbp-move-topics/#developers
CVE: CVE-2018-21006
Published: 2019-08-27
Description: The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/bbp-move-topics/#developers; https://wordpress.org/plugins/bbp-move-topics/#developers
CVE: CVE-2019-13234
Published: 2019-08-27
Description: In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154298/Alkacon-OpenCMS-10.5.x-Cross-Site-Scripting.html; https://aetsu.github.io/OpenCms; https://github.com/alkacon/apollo-template/commits/branch_10_5_x
CVE: CVE-2019-13235
Published: 2019-08-27
Description: In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154298/Alkacon-OpenCMS-10.5.x-Cross-Site-Scripting.html; https://aetsu.github.io/OpenCms; https://github.com/alkacon/apollo-template/commits/branch_10_5_x
CVE: CVE-2019-13236
Published: 2019-08-27
Description: In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154283/Alkacon-OpenCMS-10.5.x-Cross-Site-Scripting.html; https://aetsu.github.io/OpenCms; https://github.com/alkacon/opencms-core/commits/branch_10_5_x
CVE: CVE-2019-13237
Published: 2019-08-27
Description: In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/154281/Alkacon-OpenCMS-10.5.x-Local-File-Inclusion.html; https://aetsu.github.io/OpenCms; https://github.com/alkacon/opencms-core/commits/branch_10_5_x
CVE: CVE-2019-15643
Published: 2019-08-27
Description: The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-faqs/#developers; https://wpvulndb.com/vulnerabilities/9833; https://wordpress.org/plugins/ultimate-faqs/#developers
CVE: CVE-2019-15644
Published: 2019-08-27
Description: The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/zoho-salesiq/#developers; https://wpvulndb.com/vulnerabilities/9433; https://wordpress.org/plugins/zoho-salesiq/#developers
CVE: CVE-2019-15645
Published: 2019-08-27
Description: The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/zoho-salesiq/#developers; https://wpvulndb.com/vulnerabilities/9433; https://wordpress.org/plugins/zoho-salesiq/#developers
CVE: CVE-2019-15646
Published: 2019-08-27
Description: The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/log/rsvpmaker/tags/6.2; https://wordpress.org/plugins/rsvpmaker/#developers; https://wpvulndb.com/vulnerabilities/9830
CVE: CVE-2019-15647
Published: 2019-08-27
Description: The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://wordpress.org/plugins/groundhogg/#developers; https://wpvulndb.com/vulnerabilities/9834; https://www.pluginvulnerabilities.com/2019/04/05/our-proactive-monitoring-caught-an-authenticated-remote-code-execution-rce-vulnerability-being-introduced-in-to-groundhogg
CVE: CVE-2019-15648
Published: 2019-08-27
Description: The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-287, CWE-352, CWE-862
References: https://wordpress.org/plugins/insert-or-embed-articulate-content-into-wordpress/#developers; https://wpvulndb.com/vulnerabilities/9416; https://wordpress.org/plugins/insert-or-embed-articulate-content-into-wordpress/#developers
CVE: CVE-2019-15649
Published: 2019-08-27
Description: The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://wordpress.org/plugins/insert-or-embed-articulate-content-into-wordpress/#developers; https://wpvulndb.com/vulnerabilities/9415; https://wordpress.org/plugins/insert-or-embed-articulate-content-into-wordpress/#developers
CVE: CVE-2019-15659
Published: 2019-08-27
Description: The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/pie-register/#developers; https://wpvulndb.com/vulnerabilities/9835; https://wordpress.org/plugins/pie-register/#developers
CVE: CVE-2015-9348
Published: 2019-08-27
Description: The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://wordpress.org/plugins/sell-downloads/#developers; https://wordpress.org/plugins/sell-downloads/#developers
CVE: CVE-2015-9350
Published: 2019-08-27
Description: The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/feed-them-social/#developers; https://wordpress.org/plugins/feed-them-social/#developers
CVE: CVE-2015-9351
Published: 2019-08-27
Description: The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://wordpress.org/plugins/feed-them-social/#developers; https://wordpress.org/plugins/feed-them-social/#developers
CVE: CVE-2015-9352
Published: 2019-08-27
Description: The wp-polls plugin before 2.72 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/wp-polls/#developers; https://wordpress.org/plugins/wp-polls/#developers
CVE: CVE-2016-10936
Published: 2019-08-27
Description: The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-polls/#developers; https://wordpress.org/plugins/wp-polls/#developers
CVE: CVE-2017-18591
Published: 2019-08-27
Description: The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gd-rating-system/#developers; https://wordpress.org/plugins/gd-rating-system/#developers
CVE: CVE-2017-18592
Published: 2019-08-27
Description: The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://wordpress.org/plugins/woocommerce-catalog-enquiry/#developers; https://wordpress.org/plugins/woocommerce-catalog-enquiry/#developers
CVE: CVE-2019-15650
Published: 2019-08-27
Description: The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
CVSS Score: 4.3 (MEDIUM)
References: https://wordpress.org/plugins/stops-core-theme-and-plugin-updates/#developers; https://wpvulndb.com/vulnerabilities/9837; https://wordpress.org/plugins/stops-core-theme-and-plugin-updates/#developers
CVE: CVE-2019-15660
Published: 2019-08-27
Description: The wp-members plugin before 3.2.8 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-members/#developers; https://wordpress.org/plugins/wp-members/#developers
CVE: CVE-2019-11457
Published: 2019-08-27
Description: Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/154219/Django-CRM-0.2.1-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2019/Aug/30; https://www.netsparker.com/blog/web-security/
CVE: CVE-2019-14314
Published: 2019-08-27
Description: A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://de.wordpress.org/plugins/nextgen-gallery/#developers; https://wordpress.org/plugins/nextgen-gallery/#developers; https://wpvulndb.com/vulnerabilities/9816
CVE: CVE-2019-13271
Published: 2019-08-27
Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
CVSS Score: 8.8 (HIGH)
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13273
Published: 2019-08-27
Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that triggers an sprintf of the srcdb parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c
CVE: CVE-2019-13274
Published: 2019-08-27
Description: In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/csvinfo.c
CVE: CVE-2019-13451
Published: 2019-08-27
Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/history.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-13452
Published: 2019-08-27
Description: In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/reportlog.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-13455
Published: 2019-08-27
Description: In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of &nbsp; expansion in acknowledge.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/acknowledge.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-13484
Published: 2019-08-27
Description: In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of &nbsp; expansion in appfeed.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/appfeed.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-13485
Published: 2019-08-27
Description: In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/history.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-13486
Published: 2019-08-27
Description: In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of &nbsp; expansion in svcstatus.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/svn2github/xymon/blob/master/branches/4.3.28/web/svcstatus.c; https://lists.debian.org/debian-lts-announce/2019/08/msg00032.html; https://lists.xymon.com/archive/2019-July/046570.html
CVE: CVE-2019-15698
Published: 2019-08-27
Description: In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/OctopusDeploy/Issues/issues/5810; https://github.com/OctopusDeploy/Issues/issues/5810
CVE: CVE-2019-13263
Published: 2019-08-27
Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-669
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13264
Published: 2019-08-27
Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
CVSS Score: 8.8 (HIGH)
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13265
Published: 2019-08-27
Description: D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
CVSS Score: 8.8 (HIGH)
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13266
Published: 2019-08-27
Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-669
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13267
Published: 2019-08-27
Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
CVSS Score: 8.8 (HIGH)
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter