deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/errata/RHBA-2019:0326; https://access.redhat.com/errata/RHBA-2019:0327; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHBA-2019:0326; https://access.redhat.com/errata/RHBA-2019:0327; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHBA-2019:0326; https://access.redhat.com/errata/RHBA-2019:0327; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%281%29; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%281%29
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-602; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-602
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-886; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-886
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1153; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1153
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-06
Description: A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271; https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271
CVE: CVE-2018-20755
Published: 2019-02-06
Description: MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/issues/14102; https://github.com/modxcms/revolution/issues/14102
CVE: CVE-2018-20756
Published: 2019-02-06
Description: MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/issues/14105; https://github.com/modxcms/revolution/issues/14105
CVE: CVE-2018-20757
Published: 2019-02-06
Description: MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/issues/14104; https://github.com/modxcms/revolution/issues/14104
CVE: CVE-2018-20758
Published: 2019-02-06
Description: MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/modxcms/revolution/issues/14103; https://github.com/modxcms/revolution/issues/14103
CVE: CVE-2015-9282
Published: 2019-02-06
Description: The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/issues/4117; https://github.com/grafana/piechart-panel/issues/3; https://github.com/grafana/piechart-panel/pull/163
CVE: CVE-2019-3463
Published: 2019-02-06
Description: Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: http://seclists.org/fulldisclosure/2021/May/78; http://www.securityfocus.com/bid/106839; https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html
CVE: CVE-2019-3464
Published: 2019-02-06
Description: Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: http://seclists.org/fulldisclosure/2021/May/78; http://www.securityfocus.com/bid/106839; https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html
CVE: CVE-2018-16890
Published: 2019-02-06
Description: libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125, CWE-190
References: http://www.securityfocus.com/bid/106947; https://access.redhat.com/errata/RHSA-2019:3701; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890
CVE: CVE-2019-3820
Published: 2019-02-06
Description: It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00049.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820
CVE: CVE-2019-3822
Published: 2019-02-06
Description: libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/106950; https://access.redhat.com/errata/RHSA-2019:3701; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822
CVE: CVE-2019-3823
Published: 2019-02-06
Description: libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/106950; https://access.redhat.com/errata/RHSA-2019:3701; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823
CVE: CVE-2019-3825
Published: 2019-02-06
Description: A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825; https://usn.ubuntu.com/3892-1/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825
CVE: CVE-2018-3973
Published: 2019-02-06
Description: An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0. A specially crafted CAL image processed via the application can lead to an out of bounds write overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106809; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0638; http://www.securityfocus.com/bid/106809
CVE: CVE-2018-3976
Published: 2019-02-06
Description: An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Draw version 5.0.0.28. A specially crafted CAL image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a CAL image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106809; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0642; http://www.securityfocus.com/bid/106809
CVE: CVE-2018-3980
Published: 2019-02-06
Description: An exploitable out-of-bounds write exists in the TIFF-parsing functionality of Canvas Draw version 5.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0648; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0648
CVE: CVE-2019-6517
Published: 2019-02-06
Description: BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may allow for unauthorized access to administrative level functions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/106766; https://ics-cert.us-cert.gov/advisories/ICSMA-19-029-02; http://www.securityfocus.com/bid/106766
CVE: CVE-2019-7543
Published: 2019-02-06
Description: In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor; https://github.com/0xUhaw/CVE-Bins/tree/master/KindEditor
CVE: CVE-2019-7544
Published: 2019-02-06
Description: An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name Field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xUhaw/CVE-Bins/tree/master/MyWebSQL; https://github.com/0xUhaw/CVE-Bins/tree/master/MyWebSQL
CVE: CVE-2019-7545
Published: 2019-02-06
Description: In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xUhaw/CVE-Bins/tree/master/DbNinja; https://github.com/0xUhaw/CVE-Bins/tree/master/DbNinja
CVE: CVE-2019-7546
Published: 2019-02-06
Description: An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xUhaw/CVE-Bins/tree/master/SIDU/Reflected%20XSS; https://github.com/0xUhaw/CVE-Bins/tree/master/SIDU/Reflected%20XSS
CVE: CVE-2019-7547
Published: 2019-02-06
Description: An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xUhaw/CVE-Bins/tree/master/SIDU/Stored%20XSS; https://github.com/0xUhaw/CVE-Bins/tree/master/SIDU/Stored%20XSS
CVE: CVE-2019-7548
Published: 2019-02-06
Description: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
CVE: CVE-2018-17203
Published: 2019-02-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018.  Notes: none
CVE: CVE-2018-20246
Published: 2019-02-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018.  Notes: none
CVE: CVE-2018-20760
Published: 2019-02-06
Description: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/commit/4c1360818fc8948e9307059fba4dc47ba8ad255d; https://github.com/gpac/gpac/issues/1177; https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html
CVE: CVE-2018-20761
Published: 2019-02-06
Description: GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/gpac/gpac/commit/35ab4475a7df9b2a4bcab235e379c0c3ec543658; https://github.com/gpac/gpac/issues/1186; https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html
CVE: CVE-2018-20762
Published: 2019-02-06
Description: GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/gpac/gpac/commit/35ab4475a7df9b2a4bcab235e379c0c3ec543658; https://github.com/gpac/gpac/issues/1187; https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html
CVE: CVE-2018-20763
Published: 2019-02-06
Description: In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because of missing szLineConv bounds checking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/gpac/gpac/commit/1c449a34fe0b50aaffb881bfb9d7c5ab0bb18cdd; https://github.com/gpac/gpac/issues/1188; https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html
CVE: CVE-2018-7813
Published: 2019-02-06
Description: A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to be executed when parsing a GD1 file
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/106218; https://www.schneider-electric.com/ww/en/download/document/SEVD-2018-338-01; http://www.securityfocus.com/bid/106218
CVE: CVE-2018-7814
Published: 2019-02-06
Description: A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to be executed when parsing a GD1 file
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106218; https://www.schneider-electric.com/ww/en/download/document/SEVD-2018-338-01; http://www.securityfocus.com/bid/106218
CVE: CVE-2018-7815
Published: 2019-02-06
Description: A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code to be executed when parsing a GD1 file
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/106218; https://www.schneider-electric.com/ww/en/download/document/SEVD-2018-338-01; http://www.securityfocus.com/bid/106218
CVE: CVE-2018-7817
Published: 2019-02-06
Description: A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.securityfocus.com/bid/106481; https://ics-cert.us-cert.gov/advisories/ICSA-19-008-01; https://www.schneider-electric.com/en/download/document/SEVD-2018-361-01/
CVE: CVE-2018-7839
Published: 2019-02-06
Description: A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-008-02; https://www.schneider-electric.com/en/download/document/SEVD-2018-354-03/; https://ics-cert.us-cert.gov/advisories/ICSA-19-008-02
CVE: CVE-2019-7559
Published: 2019-02-07
Description: In btor2parser/btor2parser.c in Boolector Btor2Tools before 2019-01-15, opening a specially crafted input file leads to an out of bounds write in pusht_bfr.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/Boolector/boolector/issues/30; https://github.com/Boolector/boolector/issues/30
CVE: CVE-2019-7560
Published: 2019-02-07
Description: In parser/btorsmt2.c in Boolector 3.0.0, opening a specially crafted input file leads to a use after free in get_failed_assumptions or btor_delete.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/Boolector/boolector/issues/28; https://github.com/Boolector/boolector/issues/29; https://github.com/Boolector/boolector/issues/28
CVE: CVE-2019-7566
Published: 2019-02-07
Description: CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/cskaza/cszcms/issues/17; https://github.com/cskaza/cszcms/issues/17