deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-17314
Published: 2019-10-07
Description: SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-041/; https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2019-041/
CVE: CVE-2019-3745
Published: 2019-10-07
Description: The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL, which would allow the attacker to execute arbitrary code in the context of an administrator.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-426
References: https://www.dell.com/support/article/SLN318889; https://www.dell.com/support/article/SLN318889
CVE: CVE-2019-13120
Published: 2019-10-07
Description: Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://aws.amazon.com/cn/freertos/security-updates/; https://aws.amazon.com/cn/freertos/security-updates/
CVE: CVE-2019-16913
Published: 2019-10-07
Description: PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called SecurityService that runs as LocalSystem. This allows any user to escalate privileges to "NT AUTHORITY\SYSTEM" by substituting the service's binary with a Trojan horse.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://flipflopsecurity.wordpress.com/2019/10/07/pc-protect-v4-14-31-privilege-esclation/; https://flipflopsecurity.wordpress.com/2019/10/07/pc-protect-v4-14-31-privilege-esclation/
CVE: CVE-2019-17239
Published: 2019-10-07
Description: includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/download-plugins-dashboard/#developers; https://wpvulndb.com/vulnerabilities/9896; https://wordpress.org/plugins/download-plugins-dashboard/#developers
CVE: CVE-2019-17232
Published: 2019-10-07
Description: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/; https://wordpress.org/plugins/ultimate-faqs/#developers; https://wpvulndb.com/vulnerabilities/9883
CVE: CVE-2019-17233
Published: 2019-10-07
Description: Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/; https://wordpress.org/plugins/ultimate-faqs/#developers; https://wpvulndb.com/vulnerabilities/9883
CVE: CVE-2019-17350
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://xenbits.xen.org/xsa/advisory-295.html; https://seclists.org/bugtraq/2020/Jan/21; https://www.debian.org/security/2020/dsa-4602
CVE: CVE-2019-17351
Published: 2019-10-08
Description: An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2019/10/25/9; http://xenbits.xen.org/xsa/advisory-300.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
CVE: CVE-2019-17340
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-401
References: http://www.openwall.com/lists/oss-security/2019/10/25/1; http://xenbits.xen.org/xsa/advisory-284.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17341
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2019/10/25/6; http://xenbits.xen.org/xsa/advisory-285.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17342
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2019/10/25/2; http://xenbits.xen.org/xsa/advisory-287.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17343
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-667
References: http://www.openwall.com/lists/oss-security/2019/10/25/10; http://xenbits.xen.org/xsa/advisory-288.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17344
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-662
References: http://www.openwall.com/lists/oss-security/2019/10/25/3; http://xenbits.xen.org/xsa/advisory-290.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17345
Published: 2019-10-08
Description: An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/10/25/4; http://xenbits.xen.org/xsa/advisory-291.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17346
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2019/10/25/5; http://xenbits.xen.org/xsa/advisory-292.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17347
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2019/10/25/8; http://xenbits.xen.org/xsa/advisory-293.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17348
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2019/10/25/7; http://xenbits.xen.org/xsa/advisory-294.html; https://seclists.org/bugtraq/2020/Jan/21
CVE: CVE-2019-17349
Published: 2019-10-08
Description: An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://xenbits.xen.org/xsa/advisory-295.html; https://seclists.org/bugtraq/2020/Jan/21; https://www.debian.org/security/2020/dsa-4602
CVE: CVE-2019-17241
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]00d563.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17242
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]00966f.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17243
Published: 2019-10-08
Description: IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x[PII_REDACTED]003155.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17244
Published: 2019-10-08
Description: IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x[PII_REDACTED]001d8a.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17245
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]004359.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17246
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]00258c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17247
Published: 2019-10-08
Description: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x[PII_REDACTED]007da8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17248
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]0025b6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17249
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]00d57b.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17250
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x[PII_REDACTED]0042f5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17251
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007d43.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17252
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x[PII_REDACTED]000115.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17253
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x[PII_REDACTED]00a6b8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17254
Published: 2019-10-08
Description: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x[PII_REDACTED]000101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17255
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x[PII_REDACTED]010836.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17256
Published: 2019-10-08
Description: IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x[PII_REDACTED]001203.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17257
Published: 2019-10-08
Description: IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x[PII_REDACTED]02af80.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17258
Published: 2019-10-08
Description: IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x[PII_REDACTED]00839c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.irfanview.com/main_history.htm; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17259
Published: 2019-10-08
Description: KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x[PII_REDACTED]14d6ee.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.kmplayer.com; https://github.com/linhlhq/research/blob/master/README.md; http://www.kmplayer.com
CVE: CVE-2019-17260
Published: 2019-10-08
Description: MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x[PII_REDACTED]00004e.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/linhlhq/research/blob/master/README.md; https://mpc-hc.org/changelog/; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17261
Published: 2019-10-08
Description: XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x[PII_REDACTED]001e51.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.xnview.com/en/xnview/#changelog; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2019-17262
Published: 2019-10-08
Description: XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x[PII_REDACTED]001fc0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/linhlhq/research/blob/master/README.md; https://www.xnview.com/en/xnview/#changelog; https://github.com/linhlhq/research/blob/master/README.md
CVE: CVE-2018-21020
Published: 2019-10-08
Description: In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7084; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2018-21021
Published: 2019-10-08
Description: img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7086; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2018-21022
Published: 2019-10-08
Description: makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7087; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2018-21023
Published: 2019-10-08
Description: getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7083; https://github.com/centreon/centreon/pull/7271
CVE: CVE-2018-21025
Published: 2019-10-08
Description: In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/issues/7082; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2019-13336
Published: 2019-10-08
Description: The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, because the loginuse and loginpass parameters to openlock.cgi can have arbitrary values. NOTE: the vendor's position is that this product reached end of life in 2016.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://noahclements.com/Improper-Input-Validation-on-dbell-Smart-Doorbell-Can-Lead-To-Attackers-Remotely-Unlocking-Door/; https://www.reddit.com/r/AskNetsec/comments/c9p22m/company_threatening_to_sue_me_if_i_publicly/; https://www.youtube.com/watch?v=SkTKt1nV57I
CVE: CVE-2019-14656
Published: 2019-10-08
Description: Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://cerebusforensics.com/yealink/exploit.html; https://sway.office.com/3pCb559LYVuT0eig; http://cerebusforensics.com/yealink/exploit.html
CVE: CVE-2019-14657
Published: 2019-10-08
Description: Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: http://cerebusforensics.com/yealink/exploit.html; https://sway.office.com/3pCb559LYVuT0eig; http://cerebusforensics.com/yealink/exploit.html
CVE: CVE-2019-16416
Published: 2019-10-08
Description: HRworks 3.36.9 allows XSS via the purpose of a travel-expense report.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/svennergr/501409fbdb0ef4a8b0f07a26a2815fbb; https://www.hrworks.de; https://gist.github.com/svennergr/501409fbdb0ef4a8b0f07a26a2815fbb
CVE: CVE-2019-16417
Published: 2019-10-08
Description: HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/svennergr/204038bda1849ebce9af32eea9e55038; https://www.hrworks.de/kategorie/news/flow/; https://gist.github.com/svennergr/204038bda1849ebce9af32eea9e55038
CVE: CVE-2019-16929
Published: 2019-10-08
Description: Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://auth0.com/docs/security/bulletins/cve-2019-16929; https://auth0.com/docs/security/bulletins/cve-2019-16929
CVE: CVE-2019-17104
Published: 2019-10-08
Description: In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
CVSS Score: 7.5 (HIGH)
CWE: CWE-565
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/issues/7097; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2019-17106
Published: 2019-10-08
Description: In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/issues/7098; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2019-17107
Published: 2019-10-08
Description: minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7099; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2019-17108
Published: 2019-10-08
Description: Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/09/2; https://github.com/centreon/centreon/pull/7101; https://www.openwall.com/lists/oss-security/2019/10/08/1
CVE: CVE-2019-17271
Published: 2019-10-08
Description: vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/154758/vBulletin-5.5.4-SQL-Injection.html; https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa; http://packetstormsecurity.com/files/154758/vBulletin-5.5.4-SQL-Injection.html