deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0937
Published: 2019-05-16
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0937; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0937
CVE: CVE-2019-0938
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.
CVSS Score: 9.0 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0938; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0938
CVE: CVE-2019-0940
Published: 2019-05-16
Description: A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0940; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0940
CVE: CVE-2019-0942
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access to the registry, aka 'Unified Write Filter Elevation of Privilege Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0942; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0942
CVE: CVE-2019-0945
Published: 2019-05-16
Description: A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0946, CVE-2019-0947.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0945; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0945
CVE: CVE-2019-0946
Published: 2019-05-16
Description: A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0947.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0946; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0946
CVE: CVE-2019-0947
Published: 2019-05-16
Description: A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0946.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0947; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0947
CVE: CVE-2019-0949
Published: 2019-05-16
Description: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0950, CVE-2019-0951.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0949; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0949
CVE: CVE-2019-0950
Published: 2019-05-16
Description: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0951.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0950; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0950
CVE: CVE-2019-0951
Published: 2019-05-16
Description: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0950.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0951; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0951
CVE: CVE-2019-0952
Published: 2019-05-16
Description: A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0952; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0952
CVE: CVE-2019-0953
Published: 2019-05-16
Description: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0953; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0953
CVE: CVE-2019-0956
Published: 2019-05-16
Description: An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Server Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0956; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0956
CVE: CVE-2019-0957
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0958.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0957; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0957
CVE: CVE-2019-0958
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0957.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0958; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0958
CVE: CVE-2019-0961
Published: 2019-05-16
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0882.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0961; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0961
CVE: CVE-2019-0963
Published: 2019-05-16
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0963; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0963
CVE: CVE-2019-0971
Published: 2019-05-16
Description: An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0971; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0971
CVE: CVE-2019-0976
Published: 2019-05-16
Description: A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/108210; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976; http://www.securityfocus.com/bid/108210
CVE: CVE-2019-0979
Published: 2019-05-16
Description: A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0872.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0979; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0979
CVE: CVE-2019-0980
Published: 2019-05-16
Description: A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://access.redhat.com/errata/RHSA-2019:1259; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980; https://access.redhat.com/errata/RHSA-2019:1259
CVE: CVE-2019-0981
Published: 2019-05-16
Description: A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://access.redhat.com/errata/RHSA-2019:1259; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981; https://access.redhat.com/errata/RHSA-2019:1259
CVE: CVE-2019-0982
Published: 2019-05-16
Description: A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0982; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0982
CVE: CVE-2019-0995
Published: 2019-05-16
Description: A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer Security Feature Bypass Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0995; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0995
CVE: CVE-2019-1000
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell cmdlets in context of a privileged account, and perform privileged actions.To exploit this, an attacker would need to authenticate to the AzureÃ‚Â AD Connect server, aka 'Microsoft Azure AD Connect Elevation of Privilege Vulnerability'.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1000; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1000
CVE: CVE-2019-1008
Published: 2019-05-16
Description: A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.
CVSS Score: 5.9 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008
CVE: CVE-2019-3839
Published: 2019-05-16
Description: It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-648
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
CVE: CVE-2019-10909
Published: 2019-05-16
Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2; https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine; https://www.drupal.org/sa-core-2019-005
CVE: CVE-2019-10910
Published: 2019-05-16
Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/symfony/symfony/commit/d2fb[PII_REDACTED]a1da7985f0b56960b5bb10737b; https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid; https://www.synology.com/security/advisory/Synology_SA_19_19
CVE: CVE-2019-10911
Published: 2019-05-16
Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081; https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash; https://www.synology.com/security/advisory/Synology_SA_19_19
CVE: CVE-2019-10912
Published: 2019-05-16
Description: In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
CVSS Score: 7.1 (HIGH)
CWE: CWE-502
References: https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
CVE: CVE-2019-10913
Published: 2019-05-16
Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79, CWE-89
References: https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec; https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides; https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
CVE: CVE-2019-8924
Published: 2019-05-17
Description: XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151756/XAMPP-5.6.8-Cross-Site-Scripting-SQL-Injection.html; http://seclists.org/fulldisclosure/2019/Feb/43; http://www.securityfocus.com/bid/107168
CVE: CVE-2019-8925
Published: 2019-05-17
Description: An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/151757/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-Traversal-XSS.html; http://seclists.org/fulldisclosure/2019/Feb/45; https://www.exploit-db.com/exploits/46425/
CVE: CVE-2018-20839
Published: 2019-05-17
Description: systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/108389; https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993; https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b[PII_REDACTED]2aeb322f
CVE: CVE-2018-7191
Published: 2019-05-17
Description: In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html
CVE: CVE-2019-8926
Published: 2019-05-17
Description: An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151757/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-Traversal-XSS.html; http://seclists.org/fulldisclosure/2019/Feb/45; https://www.exploit-db.com/exploits/46425/
CVE: CVE-2019-8927
Published: 2019-05-17
Description: An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, rep_schedule, rep_Type, schDesc, schName, schSource, selectDeviceDone, task, val10, and val11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151757/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-Traversal-XSS.html; http://seclists.org/fulldisclosure/2019/Feb/45; https://www.exploit-db.com/exploits/46425/
CVE: CVE-2019-8928
Published: 2019-05-17
Description: An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151757/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-Traversal-XSS.html; http://seclists.org/fulldisclosure/2019/Feb/45; https://www.exploit-db.com/exploits/46425/
CVE: CVE-2019-8929
Published: 2019-05-17
Description: An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151757/Zoho-ManageEngine-Netflow-Analyzer-Professional-7.0.0.2-Traversal-XSS.html; http://seclists.org/fulldisclosure/2019/Feb/45; https://www.exploit-db.com/exploits/46425/
CVE: CVE-2019-8937
Published: 2019-05-17
Description: HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/151779/HotelDruid-2.3-Cross-Site-Scripting.html; https://sourceforge.net/projects/hoteldruid/; https://www.exploit-db.com/exploits/46429/
CVE: CVE-2018-17179
Published: 2019-05-17
Description: An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617; https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#5.0.1_Patch_.289.2F9.2F18.29; https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617
CVE: CVE-2018-17180
Published: 2019-05-17
Description: An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/openemr/openemr/commit/4963fe4932a0a4e1e[PII_REDACTED]74e9931d09541; https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#5.0.1_Patch_.289.2F9.2F18.29; https://github.com/openemr/openemr/commit/4963fe4932a0a4e1e[PII_REDACTED]74e9931d09541
CVE: CVE-2018-17181
Published: 2019-05-17
Description: An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/openemr/openemr/commit/4963fe4932a0a4e1e[PII_REDACTED]74e9931d09541; https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#5.0.1_Patch_.289.2F9.2F18.29; https://github.com/openemr/openemr/commit/4963fe4932a0a4e1e[PII_REDACTED]74e9931d09541
CVE: CVE-2018-19585
Published: 2019-05-17
Description: GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-93
References: http://packetstormsecurity.com/files/160516/GitLab-11.4.7-Remote-Code-Execution.html; http://packetstormsecurity.com/files/160699/GitLab-11.4.7-Remote-Code-Execution.html; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/