deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1569
Published: 2019-03-26
Description: The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107564; https://securityadvisories.paloaltonetworks.com/Home/Detail/142; https://www.tenable.com/security/research/tra-2019-13
CVE: CVE-2019-1570
Published: 2019-03-26
Description: The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107564; https://securityadvisories.paloaltonetworks.com/Home/Detail/142; https://www.tenable.com/security/research/tra-2019-13
CVE: CVE-2019-1572
Published: 2019-03-26
Description: PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/107720; https://security.paloaltonetworks.com/CVE-2019-1572; http://www.securityfocus.com/bid/107720
CVE: CVE-2019-6569
Published: 2019-03-26
Description: The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-440
References: https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf
CVE: CVE-2019-1571
Published: 2019-03-26
Description: The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107564; https://securityadvisories.paloaltonetworks.com/Home/Detail/142; https://www.tenable.com/security/research/tra-2019-13
CVE: CVE-2019-7167
Published: 2019-03-27
Description: Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/; https://github.com/JinBean/CVE-Extension; https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/
CVE: CVE-2016-10744
Published: 2019-03-27
Description: In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/select2/select2/issues/4587; https://github.com/snipe/snipe-it/pull/6831; https://github.com/snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a
CVE: CVE-2019-10118
Published: 2019-03-27
Description: Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/snipe/snipe-it/pull/6831; https://github.com/snipe/snipe-it/pull/6831
CVE: CVE-2019-10124
Published: 2019-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-10125
Published: 2019-03-27
Description: An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/107655; https://patchwork.kernel.org/patch/10828359/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-9917
Published: 2019-03-27
Description: ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00018.html; https://github.com/znc/znc/commit/64613bc8b6b4adf1e32231f9844d99cd512b8973
CVE: CVE-2018-10934
Published: 2019-03-27
Description: A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2019:1159; https://access.redhat.com/errata/RHSA-2019:1160; https://access.redhat.com/errata/RHSA-2019:1161
CVE: CVE-2019-3814
Published: 2019-03-27
Description: It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
CVSS Score: 7.7 (HIGH)
CWE: CWE-295, CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html; https://access.redhat.com/errata/RHSA-2019:3467; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814
CVE: CVE-2019-3817
Published: 2019-03-27
Description: A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://access.redhat.com/errata/RHSA-2019:3583; https://access.redhat.com/errata/RHSA-2019:3898; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817
CVE: CVE-2019-3821
Published: 2019-03-27
Description: A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772, CWE-772
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821; https://github.com/ceph/civetweb/pull/33; https://usn.ubuntu.com/4035-1/
CVE: CVE-2019-3828
Published: 2019-03-27
Description: Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
CVE: CVE-2019-3840
Published: 2019-03-27
Description: A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.html; https://access.redhat.com/errata/RHSA-2019:2294
CVE: CVE-2019-3847
Published: 2019-03-27
Description: A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107489; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3847; https://moodle.org/mod/forum/discuss.php?d=384010#p1547742
CVE: CVE-2019-3877
Published: 2019-03-27
Description: A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://access.redhat.com/errata/RHSA-2019:0766; https://access.redhat.com/errata/RHSA-2019:3421; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877
CVE: CVE-2018-16207
Published: 2019-03-27
Description: PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN63981842/index.html; https://www.oss.omron.co.jp/ups/info/topics/190326.html; https://www.oss.omron.co.jp/ups/support/download/soft/poweractpro/master/poweractpro_master_windows.html
CVE: CVE-2019-5418
Published: 2019-03-27
Description: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html; http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html; http://www.openwall.com/lists/oss-security/2019/03/22/1
CVE: CVE-2019-5419
Published: 2019-03-27
Description: There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
CVE: CVE-2019-5420
Published: 2019-03-27
Description: A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-330
References: http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html; https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
CVE: CVE-2019-5926
Published: 2019-03-27
Description: Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/KinagaCMS/KinagaCMS; https://jvn.jp/en/jp/JVN06527859/index.html; https://xn--5rwx17a.xn--v8jtdudb.com/
CVE: CVE-2019-5927
Published: 2019-03-27
Description: Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN60497148/index.html; https://weban.jp/contents/c/smartphone_apri/; https://jvn.jp/en/jp/JVN60497148/index.html
CVE: CVE-2019-9862
Published: 2019-03-27
Description: An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015. Because "encrypted signal transmission" is missing, an attacker is able to eavesdrop sensitive data as cleartext (for instance, the current rolling code state).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-035.txt
CVE: CVE-2019-9863
Published: 2019-03-27
Description: Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-034.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-034.txt
CVE: CVE-2019-9860
Published: 2019-03-27
Description: Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 or FUBE50015) relative to its controlled Secvest wireless alarm system FUAA50000 3.01.01, so that sent commands by the remote control are not accepted anymore.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-330
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-036.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-036.txt
CVE: CVE-2018-5923
Published: 2019-03-27
Description: In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow potential execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://support.hp.com/us-en/document/c06169434; https://support.hp.com/us-en/document/c06169434
CVE: CVE-2018-5926
Published: 2019-03-27
Description: A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: https://support.hp.com/us-en/document/c06201418; https://support.hp.com/us-en/document/c06201418
CVE: CVE-2018-5927
Published: 2019-03-27
Description: HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code.
CVSS Score: 7.3 (HIGH)
References: https://support.hp.com/us-en/document/c06242762; https://support.hp.com/us-en/document/c06242762
CVE: CVE-2019-6536
Published: 2019-03-27
Description: Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker to execute remote code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-073-01; https://www.zerodayinitiative.com/advisories/ZDI-19-307/; https://ics-cert.us-cert.gov/advisories/ICSA-19-073-01
CVE: CVE-2017-18364
Published: 2019-03-27
Description: phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153591/phpFK-lite-version-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Jul/15; https://www.netsparker.com/web-applications-advisories/ns-17-030-multiple-reflected-xss-vulnerabilities-in-phpfkl-lite/
CVE: CVE-2017-2748
Published: 2019-03-27
Description: A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions of the Isaac Mizrahi Smartwatch mobile app. HP has no access to customer data as a result of this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://support.hp.com/us-en/document/c05976868; https://support.hp.com/us-en/document/c05976868
CVE: CVE-2017-2752
Published: 2019-03-27
Description: A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy Hilfiger TH24/7 Android app versions 2.0.0.11, 2.0.1.14, 2.1.0.16, and 2.2.0.19. HP has no access to customer data as a result of this issue.
CVSS Score: 2.1 (LOW)
CWE: CWE-254
References: https://support.hp.com/us-en/document/c05904705; https://support.hp.com/us-en/document/c05904705
CVE: CVE-2018-19466
Published: 2019-03-27
Description: A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/MauroEldritch/lempo; https://github.com/portainer/portainer/pull/2488; https://github.com/portainer/portainer/releases
CVE: CVE-2018-19641
Published: 2019-03-27
Description: Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm
CVE: CVE-2018-19642
Published: 2019-03-27
Description: Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm
CVE: CVE-2019-10231
Published: 2019-03-27
Description: Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.class.php).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://github.com/glpi-project/glpi/pull/5520; https://github.com/glpi-project/glpi/releases/tag/9.4.1.1; https://github.com/glpi-project/glpi/pull/5520
CVE: CVE-2019-10232
Published: 2019-03-27
Description: Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/684d4fc423652ec7dde21cac4d41c2df53f56b3c; https://github.com/glpi-project/glpi/commit/684d4fc423652ec7dde21cac4d41c2df53f56b3c
CVE: CVE-2019-10233
Published: 2019-03-27
Description: Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.
CVSS Score: 8.1 (HIGH)
CWE: CWE-203
References: https://github.com/glpi-project/glpi/pull/5562; https://github.com/glpi-project/glpi/releases/tag/9.4.1.1; https://github.com/glpi-project/glpi/pull/5562
CVE: CVE-2018-12546
Published: 2019-03-27
Description: In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-732
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127; https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127
CVE: CVE-2018-12550
Published: 2019-03-27
Description: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-440
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=541870; https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html; https://bugs.eclipse.org/bugs/show_bug.cgi?id=541870
CVE: CVE-2018-12551
Published: 2019-03-27
Description: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-703, CWE-287
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401; https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html; https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401
CVE: CVE-2018-18994
Published: 2019-03-27
Description: LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or allow data exfiltration.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01; https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01
CVE: CVE-2018-19016
Published: 2019-03-27
Description: Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. A remote attacker could send a crafted UDP packet to the SNMP service causing a denial-of-service condition to occur until the affected product is restarted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-02; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-02
CVE: CVE-2018-19643
Published: 2019-03-27
Description: Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm
CVE: CVE-2018-19644
Published: 2019-03-27
Description: Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm
CVE: CVE-2[PII_REDACTED]
Published: 2019-03-27
Description: A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html; https://seclists.org/bugtraq/2019/Mar/49; https://wpvulndb.com/vulnerabilities/9246