deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5043
Published: 2019-10-31
Description: An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. A set of TCP connections can cause unrestricted resource allocation, resulting in a denial of service. An attacker can connect multiple times to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0810; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0810
CVE: CVE-2019-16675
Published: 2019-10-31
Description: An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-of-bounds Read and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project to be able to manipulate data inside. After manipulation, the attacker needs to exchange the original files with the manipulated ones on the application programming workstation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert.vde.com/en-us/advisories; https://www.us-cert.gov/ics/advisories/icsa-19-302-01; https://www.zerodayinitiative.com/advisories/ZDI-19-922/
CVE: CVE-2019-16906
Published: 2019-10-31
Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no longer displayed to the normal user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-862
References: http://packetstormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.html; https://seclists.org/bugtraq/2019/Nov/0; http://packetstormsecurity.com/files/154991/Infosysta-Jira-1.6.13_J8-Push-Notification-Authentication-Bypass.html
CVE: CVE-2019-16907
Published: 2019-10-31
Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-862
References: http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.html; https://seclists.org/bugtraq/2019/Nov/0; http://packetstormsecurity.com/files/154993/Infosysta-Jira-1.6.13_J8-User-Name-Disclosure.html
CVE: CVE-2019-18226
Published: 2019-10-31
Description: Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and recorders have a potential replay attack vulnerability as a weak authentication method is retained for compatibility with legacy products.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294, CWE-294
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-04; https://www.us-cert.gov/ics/advisories/icsa-19-304-04
CVE: CVE-2019-18227
Published: 2019-10-31
Description: Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-01; https://www.zerodayinitiative.com/advisories/ZDI-19-936/; https://www.zerodayinitiative.com/advisories/ZDI-19-939/
CVE: CVE-2019-18228
Published: 2019-10-31
Description: Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HTTP packet request could result in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-02; https://www.us-cert.gov/ics/advisories/icsa-19-304-02
CVE: CVE-2019-18229
Published: 2019-10-31
Description: Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-01; https://www.zerodayinitiative.com/advisories/ZDI-19-937/; https://www.zerodayinitiative.com/advisories/ZDI-19-938/
CVE: CVE-2019-18230
Published: 2019-10-31
Description: Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio streaming over HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-03; https://www.us-cert.gov/ics/advisories/icsa-19-304-03
CVE: CVE-2013-2600
Published: 2019-11-01
Description: MiniUPnPd has information disclosure use of snprintf()
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0085.html; http://archives.neohapsis.com/archives/bugtraq/2013-07/0086.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/85774
CVE: CVE-2013-2738
Published: 2019-11-01
Description: minidlna has SQL Injection that may allow retrieval of arbitrary files
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.html; http://media.blackhat.com/bh-us-12/Briefings/Cutlip/BH_US_12_Cutlip_SQL_Exploitation_WP.pdf; https://security-tracker.debian.org/tracker/CVE-2013-2738
CVE: CVE-2019-16908
Published: 2019-11-01
Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html; https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira; http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
CVE: CVE-2019-16909
Published: 2019-11-01
Description: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (with authentication as a Jira user, but without authorization for specific projects) via the plugins/servlet/nfj/NotificationSettings URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html; https://marketplace.atlassian.com/apps/1217434/in-app-desktop-notifications-for-jira; http://packetstormsecurity.com/files/154992/Infosysta-Jira-1.6.13_J8-Project-List-Authentication-Bypass.html
CVE: CVE-2019-18636
Published: 2019-11-01
Description: A cross-site scripting (XSS) vulnerability in Jitbit .NET Forum (aka ASP.NET forum) 8.3.8 allows remote attackers to inject arbitrary web script or HTML via the gravatar URL parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://reallinkers.github.io/CVE-2019-18636/; https://www.jitbit.com/asp-net-forum/versionhistory/; https://reallinkers.github.io/CVE-2019-18636/
CVE: CVE-2005-3056
Published: 2019-11-01
Description: TWiki allows arbitrary shell command execution via the Include function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330733; https://security-tracker.debian.org/tracker/CVE-2005-3056; https://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithInclude
CVE: CVE-2013-2739
Published: 2019-11-01
Description: MiniDLNA has heap-based buffer overflow
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.html; https://security-tracker.debian.org/tracker/CVE-2013-2739; http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.html
CVE: CVE-2013-3718
Published: 2019-11-01
Description: evince is missing a check on number of pages which can lead to a segmentation fault
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://bugzilla.gnome.org/show_bug.cgi?id=701302; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-3718; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-3718
CVE: CVE-2013-4751
Published: 2019-11-01
Description: php-symfony2-Validator has loss of information during serialization
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.html; http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
CVE: CVE-2011-3923
Published: 2019-11-01
Description: Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://seclists.org/fulldisclosure/2014/Jul/38; http://www.exploit-db.com/exploits/24874; http://www.securityfocus.com/bid/51628
CVE: CVE-2012-2979
Published: 2019-11-01
Description: FreeBSD NSD before 3.2.13 allows remote attackers to crash a NSD child server process (SIGSEGV) and cause a denial of service in the NSD server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-669
References: https://security-tracker.debian.org/tracker/CVE-2012-2979; https://vuxml.freebsd.org/freebsd/17f369dc-d7e7-11e1-90a2-000c299b62e1.html; https://www.tenable.com/plugins/nessus/60150
CVE: CVE-2019-15588
Published: 2019-11-01
Description: There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78
References: https://hackerone.com/reports/688270; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]74-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09; https://hackerone.com/reports/688270
CVE: CVE-2019-6657
Published: 2019-11-01
Description: On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K22441651; https://support.f5.com/csp/article/K22441651
CVE: CVE-2019-6658
Published: 2019-11-01
Description: On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://support.f5.com/csp/article/K21121741; https://support.f5.com/csp/article/K21121741
CVE: CVE-2019-12752
Published: 2019-11-01
Description: The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276
References: https://support.symantec.com/us/en/article.SYMSA1494.html; https://support.symantec.com/us/en/article.SYMSA1494.html
CVE: CVE-2013-1666
Published: 2019-11-01
Description: Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://foswiki.org/Support/SecurityAlert-CVE-2013-1666; http://www.openwall.com/lists/oss-security/2015/03/24/20; https://security-tracker.debian.org/tracker/CVE-2013-1666
CVE: CVE-2013-2227
Published: 2019-11-01
Description: GLPI 0.83.7 has Local File Inclusion in common.tabs.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/06/30/10; http://www.securityfocus.com/bid/60692; https://access.redhat.com/security/cve/cve-2013-2227
CVE: CVE-2005-2350
Published: 2019-11-01
Description: Cross-site scripting (XSS) vulnerability in websieve v0.62 allows remote attackers to inject arbitrary web script or HTML code in the web user interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311838; https://security-tracker.debian.org/tracker/CVE-2005-2350; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311838
CVE: CVE-2010-3660
Published: 2019-11-01
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3660; https://typo3.org/security/advisory/typo3-sa-2010-012/#XSS
CVE: CVE-2010-3661
Published: 2019-11-01
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3661; https://typo3.org/security/advisory/typo3-sa-2010-012/#Open_Redirection
CVE: CVE-2013-4367
Published: 2019-11-01
Description: ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://access.redhat.com/security/cve/cve-2013-4367; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4367; https://access.redhat.com/security/cve/cve-2013-4367
CVE: CVE-2005-2351
Published: 2019-11-01
Description: Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311296; https://security-tracker.debian.org/tracker/CVE-2005-2351; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311296
CVE: CVE-2013-0165
Published: 2019-11-01
Description: cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0165; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0165
CVE: CVE-2013-0178
Published: 2019-11-01
Description: Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/01/14/5; http://www.openwall.com/lists/oss-security/2013/01/14/7; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0178
CVE: CVE-2013-0180
Published: 2019-11-01
Description: Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/01/14/7; https://bugzilla.redhat.com/show_bug.cgi?id=894659; http://www.openwall.com/lists/oss-security/2013/01/14/7
CVE: CVE-2013-0186
Published: 2019-11-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2014:0215; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0186; https://access.redhat.com/errata/RHSA-2014:0215
CVE: CVE-2013-2255
Published: 2019-11-01
Description: HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2013-2255; https://bugs.launchpad.net/ossn/+bug/1188189; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255
CVE: CVE-2019-18653
Published: 2019-11-01
Description: A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/; https://medium.com/%40YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968; http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/
CVE: CVE-2019-18654
Published: 2019-11-01
Description: A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/; https://medium.com/%40YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968; http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/
CVE: CVE-2013-4168
Published: 2019-11-01
Description: Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113987.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114008.html; http://www.openwall.com/lists/oss-security/2013/07/25/8
CVE: CVE-2005-2352
Published: 2019-11-01
Description: I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://www.attrition.org/pipermail/vim/2014-February/002758.html; https://security-tracker.debian.org/tracker/CVE-2005-2352; http://www.attrition.org/pipermail/vim/2014-February/002758.html
CVE: CVE-2019-6470
Published: 2019-11-01
Description: There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.
CVSS Score: 6.5 (MEDIUM)
References: https://access.redhat.com/errata/RHSA-2019:2060; https://access.redhat.com/errata/RHSA-2019:3525; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896122
CVE: CVE-2019-18659
Published: 2019-11-02
Description: The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are affected by design (e.g., use of Android versus iOS does not matter); testing in an open RF environment is, of course, contraindicated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://dl.acm.org/citation.cfm?id=3326082; https://dl.acm.org/citation.cfm?id=3326082
CVE: CVE-2019-18661
Published: 2019-11-02
Description: Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0 to 1. An attack does not achieve administrative control of a device; however, the attacker can view all of the web pages of the administration console.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://angeloanatrella86.github.io/CVE-2019/; https://github.com/angeloanatrella86/CVE-2019/blob/master/index.md; https://angeloanatrella86.github.io/CVE-2019/
CVE: CVE-2019-18662
Published: 2019-11-02
Description: An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query. This can be exploited by malicious users to, e.g., read sensitive data from the database through in-band SQL Injection attacks. Successful exploitation of this vulnerability requires the Live Chat plugin to be enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/155564/YouPHPTube-7.7-SQL-Injection.html; http://seclists.org/fulldisclosure/2019/Dec/9; https://github.com/YouPHPTube/YouPHPTube/issues/2202
CVE: CVE-2019-18664
Published: 2019-11-02
Description: The Log module in SECUDOS DOMOS before 5.6 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://atomic111.github.io/article/secudos-domos-reflected-xss; https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6; https://atomic111.github.io/article/secudos-domos-reflected-xss
CVE: CVE-2019-18665
Published: 2019-11-02
Description: The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://atomic111.github.io/article/secudos-domos-directory_traversal; https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6; https://www.cybersecurity-help.cz/vdb/SB[PII_REDACTED]
CVE: CVE-2019-18667
Published: 2019-11-02
Description: /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pfsense/FreeBSD-ports/commit/30b22b6b0db7b73732a5da346afca66dc244e02a; https://github.com/pfsense/FreeBSD-ports/commit/30b22b6b0db7b73732a5da346afca66dc244e02a
CVE: CVE-2019-18668
Published: 2019-11-02
Description: An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://wordpress.org/plugins/currency-switcher-woocommerce/#developers; https://wpvulndb.com/vulnerabilities/9936; https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61