deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11521
Published: 2019-08-20
Description: OX App Suite 7.10.1 allows Content Spoofing.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html
CVE: CVE-2019-11522
Published: 2019-08-20
Description: OX App Suite 7.10.0 to 7.10.2 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html
CVE: CVE-2019-11806
Published: 2019-08-20
Description: OX App Suite 7.10.1 and earlier has Insecure Permissions.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/154128/Open-Xchange-OX-App-Suite-Content-Spoofing-Cross-Site-Scripting.html
CVE: CVE-2019-14430
Published: 2019-08-20
Description: plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/YouPHPTube/YouPHPTube/commit/891843d547f7db5639925a67b7f2fd66721f703a; https://www.exploit-db.com/exploits/47294; https://github.com/YouPHPTube/YouPHPTube/commit/891843d547f7db5639925a67b7f2fd66721f703a
CVE: CVE-2019-14684
Published: 2019-08-20
Description: A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14687.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123396.aspx; https://safebreach.com/Post/Trend-Micro-Password-Manager-Privilege-Escalation-to-SYSTEM; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123396.aspx
CVE: CVE-2019-14687
Published: 2019-08-20
Description: A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14684.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123396.aspx; https://medium.com/%40infiniti_css/fa839acaad59; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123396.aspx
CVE: CVE-2019-15082
Published: 2019-08-20
Description: The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/360-product-rotation/#developers; https://wpvulndb.com/vulnerabilities/9405; https://wordpress.org/plugins/360-product-rotation/#developers
CVE: CVE-2019-15233
Published: 2019-08-20
Description: The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/l0nax/CVE-2019-15233; https://marketplace.atlassian.com/apps/1215287/live-input-macros?hosting=server&tab=versions; https://github.com/l0nax/CVE-2019-15233
CVE: CVE-2019-15290
Published: 2019-08-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-15098. Reason: This candidate is a duplicate of CVE-2019-15098. Notes: All CVE users should reference CVE-2019-15098 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-15291
Published: 2019-08-20
Description: An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html; http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2011-5328
Published: 2019-08-20
Description: The user-access-manager plugin before 1.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/user-access-manager/#developers; https://wordpress.org/plugins/user-access-manager/#developers
CVE: CVE-2014-10381
Published: 2019-08-20
Description: The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/user-domain-whitelist/#developers; https://wordpress.org/plugins/user-domain-whitelist/#developers
CVE: CVE-2015-9317
Published: 2019-08-20
Description: The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/awesome-support/#developers; https://wordpress.org/plugins/awesome-support/#developers
CVE: CVE-2015-9318
Published: 2019-08-20
Description: The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://wordpress.org/plugins/awesome-support/#developers; https://wordpress.org/plugins/awesome-support/#developers
CVE: CVE-2015-9329
Published: 2019-08-20
Description: The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-all-import/#developers; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2015-9330
Published: 2019-08-20
Description: The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/wp-all-import/#developers; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2015-9331
Published: 2019-08-20
Description: The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://wordpress.org/plugins/wp-all-import/#developers; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2015-9332
Published: 2019-08-20
Description: The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/uninstall/#developers; https://wordpress.org/plugins/uninstall/#developers
CVE: CVE-2016-10893
Published: 2019-08-20
Description: The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/aramk/crayon-syntax-highlighter/commit/7fdb2e6b4c65178b4ed01ff08a8a38afe5a5151e; https://github.com/aramk/crayon-syntax-highlighter/issues/347; https://wordpress.org/plugins/crayon-syntax-highlighter/#developers
CVE: CVE-2016-10913
Published: 2019-08-20
Description: The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-latest-posts/#developers; https://wordpress.org/plugins/wp-latest-posts/#developers
CVE: CVE-2016-10914
Published: 2019-08-20
Description: The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/add-from-server/#developers; https://wordpress.org/plugins/add-from-server/#developers
CVE: CVE-2016-10915
Published: 2019-08-20
Description: The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/popup-by-supsystic/#developers; https://wordpress.org/plugins/popup-by-supsystic/#developers
CVE: CVE-2017-18517
Published: 2019-08-20
Description: The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/bws-pinterest/#developers; https://wordpress.org/plugins/bws-pinterest/#developers
CVE: CVE-2017-18520
Published: 2019-08-20
Description: The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/democracy-poll/#developers; https://www.pluginvulnerabilities.com/2017/02/22/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-democracy-poll/; https://wordpress.org/plugins/democracy-poll/#developers
CVE: CVE-2017-18567
Published: 2019-08-20
Description: The wp-all-import plugin before 3.4.6 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-all-import/#developers; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2017-18568
Published: 2019-08-20
Description: The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/my-wp-translate/#developers; https://wordpress.org/plugins/my-wp-translate/#developers
CVE: CVE-2017-18569
Published: 2019-08-20
Description: The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/my-wp-translate/#developers; https://wordpress.org/plugins/my-wp-translate/#developers
CVE: CVE-2019-15238
Published: 2019-08-20
Description: The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/cforms2/#developers; https://wpvulndb.com/vulnerabilities/9505; https://wordpress.org/plugins/cforms2/#developers
CVE: CVE-2015-9319
Published: 2019-08-20
Description: The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gregs-high-performance-seo/#developers; https://wordpress.org/plugins/gregs-high-performance-seo/#developers
CVE: CVE-2015-9320
Published: 2019-08-20
Description: The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/option-tree/#developers; https://wpvulndb.com/vulnerabilities/9769; https://wordpress.org/plugins/option-tree/#developers
CVE: CVE-2016-10892
Published: 2019-08-20
Description: The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/chained-quiz/#developers; https://wordpress.org/plugins/chained-quiz/#developers
CVE: CVE-2016-10895
Published: 2019-08-20
Description: The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/option-tree/#developers; https://wordpress.org/plugins/option-tree/#developers
CVE: CVE-2017-18518
Published: 2019-08-20
Description: The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/bws-smtp/#developers; https://wordpress.org/plugins/bws-smtp/#developers
CVE: CVE-2017-18519
Published: 2019-08-20
Description: The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/customer-area/#developers; https://wordpress.org/plugins/customer-area/#developers
CVE: CVE-2017-18522
Published: 2019-08-20
Description: The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/eelv-newsletter/#developers; https://wordpress.org/plugins/eelv-newsletter/#developers
CVE: CVE-2017-18523
Published: 2019-08-20
Description: The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/eelv-newsletter/#developers; https://wordpress.org/plugins/eelv-newsletter/#developers
CVE: CVE-2017-18524
Published: 2019-08-20
Description: The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/football-pool/#developers; https://wordpress.org/plugins/football-pool/#developers
CVE: CVE-2017-18526
Published: 2019-08-20
Description: The moreads-se plugin before 1.4.7 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/moreads-se/#developers; https://wordpress.org/plugins/moreads-se/#developers
CVE: CVE-2017-18527
Published: 2019-08-20
Description: The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/pagination/#developers; https://wordpress.org/plugins/pagination/#developers
CVE: CVE-2017-18528
Published: 2019-08-20
Description: The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/pdf-print/#developers; https://wordpress.org/plugins/pdf-print/#developers
CVE: CVE-2017-18529
Published: 2019-08-20
Description: The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/promobar/#developers; https://wordpress.org/plugins/promobar/#developers
CVE: CVE-2017-18530
Published: 2019-08-20
Description: The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/rating-bws/#developers; https://wordpress.org/plugins/rating-bws/#developers
CVE: CVE-2017-18531
Published: 2019-08-20
Description: The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/raygun4wp/#developers; https://wordpress.org/plugins/raygun4wp/#developers
CVE: CVE-2017-18532
Published: 2019-08-20
Description: The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/realty/#developers; https://wordpress.org/plugins/realty/#developers
CVE: CVE-2017-18533
Published: 2019-08-20
Description: The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/rimons-twitter-widget/#developers; https://wordpress.org/plugins/rimons-twitter-widget/#developers
CVE: CVE-2017-18566
Published: 2019-08-20
Description: The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/user-role/#developers; https://wordpress.org/plugins/user-role/#developers
CVE: CVE-2018-20978
Published: 2019-08-20
Description: The wp-all-import plugin before 3.4.7 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-all-import/#developers; https://wordpress.org/plugins/wp-all-import/#developers
CVE: CVE-2018-18056
Published: 2019-08-20
Description: An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash memory. As a consequence, it is possible to execute single instructions with arbitrary system states (e.g., registers, status flags, and SRAM content) and observe the state changes produced by the unknown instruction. An attacker could exploit this vulnerability by executing protected and unknown instructions with specific system states and observing the state changes. Based on the gathered information, it is possible to reverse-engineer the executed instructions. The processor acts as a kind of "instruction oracle."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://www.usenix.org/conference/woot19/presentation/schink; https://www.usenix.org/system/files/woot19-paper_schink.pdf; https://www.usenix.org/conference/woot19/presentation/schink
CVE: CVE-2019-11209
Published: 2019-08-20
Description: The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1; 6.1.0, TIBCO FTL Developer Edition 6.0.1; 6.1.0, and TIBCO FTL Enterprise Edition 6.0.0; 6.0.1; 6.1.0.
CVSS Score: 8.8 (HIGH)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-20-2019-tibco-ftl; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-3963
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2019-3964
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2019-3965
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2019-3966
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2019-3967
Published: 2019-08-20
Description: In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2019-40; https://www.tenable.com/security/research/tra-2019-40
CVE: CVE-2018-1630
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144430; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1631
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144431; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1632
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144432; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1633
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144434; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1634
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144437; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1635
Published: 2019-08-20
Description: Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144439; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1636
Published: 2019-08-20
Description: Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/144441; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-1796
Published: 2019-08-20
Description: IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426.
CVSS Score: 7.8 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10964987; https://exchange.xforce.ibmcloud.com/vulnerabilities/149426; http://www.ibm.com/support/docview.wss?uid=ibm10964987
CVE: CVE-2019-10745
Published: 2019-08-20
Description: assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211; https://snyk.io/vuln/SNYK-JS-ASSIGNDEEP-450211