deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0331
Published: 2019-08-14
Description: Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
CVSS Score: 5.3 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2742468; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2742468
CVE: CVE-2019-0332
Published: 2019-08-14
Description: SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2742468; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2742468
CVE: CVE-2019-0333
Published: 2019-08-14
Description: In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2764513; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2764513
CVE: CVE-2019-0334
Published: 2019-08-14
Description: When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2771221; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2771221
CVE: CVE-2019-0335
Published: 2019-08-14
Description: Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2742468; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2742468
CVE: CVE-2019-0337
Published: 2019-08-14
Description: Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2789866; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2789866
CVE: CVE-2019-0338
Published: 2019-08-14
Description: During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/2793351; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2793351
CVE: CVE-2019-0340
Published: 2019-08-14
Description: The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: https://launchpad.support.sap.com/#/notes/2794742; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2794742
CVE: CVE-2019-0341
Published: 2019-08-14
Description: The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://launchpad.support.sap.com/#/notes/2794742; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2794742
CVE: CVE-2019-0343
Published: 2019-08-14
Description: SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/2786035; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2786035
CVE: CVE-2019-0344
Published: 2019-08-14
Description: Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://launchpad.support.sap.com/#/notes/2786035; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2786035
CVE: CVE-2019-0345
Published: 2019-08-14
Description: A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/2813811; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2813811
CVE: CVE-2019-0346
Published: 2019-08-14
Description: Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://launchpad.support.sap.com/#/notes/2764513; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2764513
CVE: CVE-2019-0348
Published: 2019-08-14
Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://launchpad.support.sap.com/#/notes/2751470; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2751470
CVE: CVE-2019-0351
Published: 2019-08-14
Description: A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.
CVSS Score: 8.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2800779; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2800779
CVE: CVE-2015-9311
Published: 2019-08-14
Description: The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2015-9312
Published: 2019-08-14
Description: The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2015-9313
Published: 2019-08-14
Description: The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2015-9314
Published: 2019-08-14
Description: The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2015-9315
Published: 2019-08-14
Description: The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2015-9316
Published: 2019-08-14
Description: The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/wp-fastest-cache/#developers; https://www.exploit-db.com/exploits/38678; https://wordpress.org/plugins/wp-fastest-cache/#developers
CVE: CVE-2016-10889
Published: 2019-08-14
Description: The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/nextgen-gallery/#developers; https://wordpress.org/plugins/nextgen-gallery/#developers
CVE: CVE-2017-18514
Published: 2019-08-14
Description: The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/simple-login-log/#developers; https://wordpress.org/plugins/simple-login-log/#developers
CVE: CVE-2019-0349
Published: 2019-08-14
Description: SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2798743; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017; https://launchpad.support.sap.com/#/notes/2798743
CVE: CVE-2019-15025
Published: 2019-08-14
Description: The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/ninja-forms/#developers; https://wordpress.org/plugins/ninja-forms/#developers
CVE: CVE-2019-15046
Published: 2019-08-14
Description: Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-79989.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/154183/Zoho-Corporation-ManageEngine-ServiceDesk-Plus-Information-Disclosure.html; http://seclists.org/fulldisclosure/2019/Aug/17; https://seclists.org/bugtraq/2019/Aug/37
CVE: CVE-2019-7870
Published: 2019-08-14
Description: Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/character_animator/apsb19-32.html; https://helpx.adobe.com/security/products/character_animator/apsb19-32.html
CVE: CVE-2019-7931
Published: 2019-08-14
Description: Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/premiere_pro/apsb19-33.html; https://helpx.adobe.com/security/products/premiere_pro/apsb19-33.html
CVE: CVE-2019-7961
Published: 2019-08-14
Description: Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/prelude/apsb19-35.html; https://helpx.adobe.com/security/products/prelude/apsb19-35.html
CVE: CVE-2019-8062
Published: 2019-08-14
Description: Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/after_effects/apsb19-31.html; https://helpx.adobe.com/security/products/after_effects/apsb19-31.html
CVE: CVE-2013-7476
Published: 2019-08-14
Description: The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/simple-fields/#developers; https://wordpress.org/plugins/simple-fields/#developers
CVE: CVE-2015-9307
Published: 2019-08-14
Description: The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wpvulndb.com/vulnerabilities/9766; https://wordpress.org/plugins/wp-google-map-plugin/#developers
CVE: CVE-2015-9308
Published: 2019-08-14
Description: The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wpvulndb.com/vulnerabilities/9766; https://wordpress.org/plugins/wp-google-map-plugin/#developers
CVE: CVE-2015-9309
Published: 2019-08-14
Description: The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wpvulndb.com/vulnerabilities/9766; https://wordpress.org/plugins/wp-google-map-plugin/#developers
CVE: CVE-2015-9310
Published: 2019-08-14
Description: The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers; https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers
CVE: CVE-2016-10880
Published: 2019-08-14
Description: The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/google-document-embedder/#developers; https://wordpress.org/plugins/google-document-embedder/#developers
CVE: CVE-2016-10881
Published: 2019-08-14
Description: The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/google-document-embedder/#developers; https://wordpress.org/plugins/google-document-embedder/#developers
CVE: CVE-2016-10882
Published: 2019-08-14
Description: The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/google-document-embedder/#developers; https://wordpress.org/plugins/google-document-embedder/#developers
CVE: CVE-2016-10883
Published: 2019-08-14
Description: The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/simple-add-pages-or-posts/#developers; https://wordpress.org/plugins/simple-add-pages-or-posts/#developers
CVE: CVE-2016-10884
Published: 2019-08-14
Description: The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/simple-membership/#developers; https://wpvulndb.com/vulnerabilities/9744; https://wordpress.org/plugins/simple-membership/#developers
CVE: CVE-2016-10885
Published: 2019-08-14
Description: The wp-editor plugin before 1.2.6 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-editor/#developers; https://wordpress.org/plugins/wp-editor/#developers
CVE: CVE-2016-10886
Published: 2019-08-14
Description: The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: https://wordpress.org/plugins/wp-editor/#developers; https://wordpress.org/plugins/wp-editor/#developers
CVE: CVE-2016-10887
Published: 2019-08-14
Description: The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers; https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers
CVE: CVE-2016-10888
Published: 2019-08-14
Description: The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers; https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers
CVE: CVE-2017-18510
Published: 2019-08-14
Description: The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/custom-sidebars/#developers; https://wordpress.org/plugins/custom-sidebars/#developers
CVE: CVE-2017-18511
Published: 2019-08-14
Description: The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/custom-sidebars/#developers; https://wordpress.org/plugins/custom-sidebars/#developers
CVE: CVE-2017-18512
Published: 2019-08-14
Description: The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/newsletter-by-supsystic/#developers; https://wordpress.org/plugins/newsletter-by-supsystic/#developers
CVE: CVE-2017-18513
Published: 2019-08-14
Description: The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/responsive-menu/#developers; https://wordpress.org/plugins/responsive-menu/#developers
CVE: CVE-2018-20967
Published: 2019-08-14
Description: The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers; https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers
CVE: CVE-2018-20968
Published: 2019-08-14
Description: The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-ultimate-exporter/#developers; https://wordpress.org/plugins/wp-ultimate-exporter/#developers
CVE: CVE-2019-11652
Published: 2019-08-14
Description: A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate.
CVSS Score: 9.8 (CRITICAL)
References: https://www.netiq.com/documentation/self-service-password-reset-42/release-notes-sspr42-p6/data/release-notes-sspr42-p6.html; https://www.netiq.com/documentation/self-service-password-reset-43/release-notes-sspr-43-p3/data/release-notes-sspr-43-p3.html; https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p3/data/release-notes-sspr-44-p3.html
CVE: CVE-2019-14974
Published: 2019-08-14
Description: SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/47247; https://www.exploit-db.com/exploits/47247
CVE: CVE-2019-15047
Published: 2019-08-14
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/bento4/issues/408; https://github.com/axiomatic-systems/bento4/issues/408
CVE: CVE-2019-15048
Published: 2019-08-14
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/axiomatic-systems/bento4/issues/409; https://github.com/axiomatic-systems/bento4/issues/409
CVE: CVE-2019-15049
Published: 2019-08-14
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/bento4/issues/408; https://github.com/axiomatic-systems/bento4/issues/408
CVE: CVE-2019-15050
Published: 2019-08-14
Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/bento4/issues/409; https://github.com/axiomatic-systems/bento4/issues/409
CVE: CVE-2019-10199
Published: 2019-08-14
Description: It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10199; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10199
CVE: CVE-2019-10201
Published: 2019-08-14
Description: It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-592, CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10201