deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-3593
Published: 2019-01-28
Description: Exploitation of Privilege/Trust vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.R18 allows local users to bypass product self-protection, tamper with policies and product files, and uninstall McAfee software without permission via specially crafted malware.
CVSS Score: 7.5 (HIGH)
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS102888; http://service.mcafee.com/FAQDocument.aspx?&id=TS102888
CVE: CVE-2018-19724
Published: 2019-01-28
Description: Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106677; https://helpx.adobe.com/security/products/aem-forms/apsb19-03.html; http://www.securityfocus.com/bid/106677
CVE: CVE-2018-19726
Published: 2019-01-28
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106679; https://helpx.adobe.com/security/products/experience-manager/apsb19-09.html; http://www.securityfocus.com/bid/106679
CVE: CVE-2018-19727
Published: 2019-01-28
Description: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106678; https://helpx.adobe.com/security/products/experience-manager/apsb19-09.html; http://www.securityfocus.com/bid/106678
CVE: CVE-2018-19728
Published: 2019-01-28
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html
CVE: CVE-2018-19015
Published: 2019-01-28
Description: An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/106654; https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01; http://www.securityfocus.com/bid/106654
CVE: CVE-2019-6990
Published: 2019-01-28
Description: A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/commit/a3e8fd4fd5b579865f35aac3b964bc78d5b7a94a; https://github.com/ZoneMinder/zoneminder/issues/2444; https://github.com/ZoneMinder/zoneminder/commit/a3e8fd4fd5b579865f35aac3b964bc78d5b7a94a
CVE: CVE-2019-6991
Published: 2019-01-28
Description: A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to execute code via a long username.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ZoneMinder/zoneminder/issues/2478; https://github.com/ZoneMinder/zoneminder/pull/2482; https://github.com/ZoneMinder/zoneminder/issues/2478
CVE: CVE-2019-6992
Published: 2019-01-28
Description: A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ZoneMinder/zoneminder/commit/8c5687ca308e441742725e0aff9075779fa1a498; https://github.com/ZoneMinder/zoneminder/issues/2445; https://github.com/ZoneMinder/zoneminder/commit/8c5687ca308e441742725e0aff9075779fa1a498
CVE: CVE-2018-19012
Published: 2019-01-28
Description: Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialog it is possible to break out of the kiosk mode and reach the underlying operating system. By breaking out of the kiosk mode, an attacker is able to take control of the operating system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/106683; https://ics-cert.us-cert.gov/advisories/ICSMA-19-022-01; http://www.securityfocus.com/bid/106683
CVE: CVE-2019-3462
Published: 2019-01-28
Description: Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/106690; https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E; https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html
CVE: CVE-2018-19010
Published: 2019-01-28
Description: Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A malformed network packet may cause the monitor to reboot. By repeatedly sending the malformed network packet, an attacker may be able to disrupt patient monitoring by causing the monitor to repeatedly reboot until it falls back to default configuration and loses network connectivity.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/106683; https://ics-cert.us-cert.gov/advisories/ICSMA-19-022-01; http://www.securityfocus.com/bid/106683
CVE: CVE-2018-19014
Published: 2019-01-28
Description: Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Log files are accessible over an unauthenticated network connection. By accessing the log files, an attacker is able to gain insights about internals of the patient monitor, the location of the monitor, and wired network configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://www.securityfocus.com/bid/106683; https://ics-cert.us-cert.gov/advisories/ICSMA-19-022-01; http://www.securityfocus.com/bid/106683
CVE: CVE-2018-19721
Published: 2019-01-28
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. Note: A different vulnerability than CVE-2018-19723.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb18-34.html; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-19723
Published: 2019-01-28
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. Note: A different vulnerability than CVE-2018-19721.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106751; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html; http://www.securityfocus.com/bid/106751
CVE: CVE-2019-7146
Published: 2019-01-29
Description: In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:3575; https://sourceware.org/bugzilla/show_bug.cgi?id=24075; https://sourceware.org/bugzilla/show_bug.cgi?id=24081
CVE: CVE-2019-7147
Published: 2019-01-29
Description: A buffer over-read exists in the function crc64ib in crc64.c in nasmlib in Netwide Assembler (NASM) 2.14rc16. A crafted asm input can cause segmentation faults, leading to denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392544; https://bugzilla.nasm.us/show_bug.cgi?id=3392544
CVE: CVE-2019-7148
Published: 2019-01-29
Description: An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://sourceware.org/bugzilla/show_bug.cgi?id=24085; https://sourceware.org/bugzilla/show_bug.cgi?id=24085
CVE: CVE-2019-7149
Published: 2019-01-29
Description: A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2197; https://access.redhat.com/errata/RHSA-2019:3575; https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
CVE: CVE-2019-7150
Published: 2019-01-29
Description: An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html; https://access.redhat.com/errata/RHSA-2019:2197; https://access.redhat.com/errata/RHSA-2019:3575
CVE: CVE-2019-7151
Published: 2019-01-29
Description: A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/WebAssembly/binaryen/issues/1881; https://github.com/WebAssembly/binaryen/issues/1881
CVE: CVE-2019-7152
Published: 2019-01-29
Description: A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/WebAssembly/binaryen/issues/1880; https://github.com/WebAssembly/binaryen/issues/1880
CVE: CVE-2019-7153
Published: 2019-01-29
Description: A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/WebAssembly/binaryen/issues/1879; https://github.com/WebAssembly/binaryen/issues/1879
CVE: CVE-2019-7154
Published: 2019-01-29
Description: The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/WebAssembly/binaryen/issues/1876; https://github.com/WebAssembly/binaryen/issues/1876
CVE: CVE-2016-10740
Published: 2019-01-29
Description: Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://jira.atlassian.com/browse/CWD-5060; https://jira.atlassian.com/browse/CWD-5060
CVE: CVE-2019-7156
Published: 2019-01-29
Description: In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://www.securityfocus.com/bid/106813; https://github.com/uvoteam/libdoc/issues/5; http://www.securityfocus.com/bid/106813
CVE: CVE-2018-10612
Published: 2019-01-29
Description: In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-311, CWE-732
References: http://www.securityfocus.com/bid/106248; https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03; http://www.securityfocus.com/bid/106248
CVE: CVE-2018-1668
Published: 2019-01-29
Description: IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. IBM X-Force ID: 144894.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/144894; https://www.ibm.com/support/docview.wss?uid=ibm10794735; https://exchange.xforce.ibmcloud.com/vulnerabilities/144894
CVE: CVE-2018-16880
Published: 2019-01-29
Description: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00037.html; http://www.securityfocus.com/bid/106735; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16880
CVE: CVE-2018-1733
Published: 2019-01-29
Description: IBM QRadar SIEM 7.2 and 7.3 fails to adequately filter user-controlled input data for syntax that has control-plane implications which could allow an attacker to modify displayed content. IBM X-Force ID: 147811.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/106793; https://exchange.xforce.ibmcloud.com/vulnerabilities/147811; https://www.ibm.com/support/docview.wss?uid=ibm10794523
CVE: CVE-2018-18985
Published: 2019-01-29
Description: Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106530; https://ics-cert.us-cert.gov/advisories/ICSA-18-333-02; http://www.securityfocus.com/bid/106530
CVE: CVE-2018-1976
Published: 2019-01-29
Description: IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106792; https://exchange.xforce.ibmcloud.com/vulnerabilities/154031; https://www.ibm.com/support/docview.wss?uid=ibm10843130
CVE: CVE-2019-7160
Published: 2019-01-29
Description: idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/idreamsoft/iCMS/issues/50; https://github.com/idreamsoft/iCMS/issues/50
CVE: CVE-2019-3806
Published: 2019-01-29
Description: An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
CVSS Score: 8.1 (HIGH)
CWE: CWE-358
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806; https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806
CVE: CVE-2019-3807
Published: 2019-01-29
Description: An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation.
CVSS Score: 3.7 (LOW)
CWE: CWE-345, CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3807; https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3807
CVE: CVE-2019-7168
Published: 2019-01-29
Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/croogo/croogo/issues/886; https://github.com/croogo/croogo/issues/886
CVE: CVE-2019-7169
Published: 2019-01-29
Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/croogo/croogo/issues/888; https://github.com/croogo/croogo/issues/888
CVE: CVE-2019-7170
Published: 2019-01-29
Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/croogo/croogo/issues/890; https://github.com/croogo/croogo/issues/890
CVE: CVE-2019-7171
Published: 2019-01-29
Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/croogo/croogo/issues/887; https://github.com/croogo/croogo/issues/887
CVE: CVE-2019-7172
Published: 2019-01-29
Description: A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/atutor/ATutor/issues/164; https://github.com/atutor/ATutor/issues/164
CVE: CVE-2019-7173
Published: 2019-01-29
Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/croogo/croogo/issues/889; https://github.com/croogo/croogo/issues/889
CVE: CVE-2018-12609
Published: 2019-01-30
Description: OX App Suite 7.8.4 and earlier allows Server-Side Request Forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://seclists.org/fulldisclosure/2019/Jan/10; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf; https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE: CVE-2018-12610
Published: 2019-01-30
Description: OX App Suite 7.8.4 and earlier allows Information Exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2019/Jan/10; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf; https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE: CVE-2018-12611
Published: 2019-01-30
Description: OX App Suite 7.8.4 and earlier allows Directory Traversal.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2019/Jan/10; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4791_7.8.4_2018-06-25.pdf; https://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_4790_7.8.3_2018-06-25.pdf
CVE: CVE-2018-15136
Published: 2019-01-30
Description: TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://www.fwhibbit.es/bypassing-spam-titan-my-first-cve; https://www.fwhibbit.es/bypassing-spam-titan-my-first-cve
CVE: CVE-2018-17431
Published: 2019-01-30
Description: Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/159246/Comodo-Unified-Threat-Management-Web-Console-2.7.0-Remote-Code-Execution.html; https://drive.google.com/file/d/0BzFJhNQNHcoTbndsUmNjVWNGYWNJaWxYcWNyS2ZDajluTDFz/view; https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
CVE: CVE-2018-18895
Published: 2019-01-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-3004.  Reason: This candidate is a duplicate of CVE-2014-3004.  Notes: All CVE users should reference CVE-2014-3004 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-19440
Published: 2019-01-30
Description: ARM Trusted Firmware-A allows information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/ARM-software/arm-trusted-firmware/pull/1710; https://github.com/ARM-software/arm-trusted-firmware/wiki/Trusted-Firmware-A-Security-Advisory-TFV-8; https://github.com/ARM-software/arm-trusted-firmware/pull/1710
CVE: CVE-2018-19782
Published: 2019-01-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the (1) c parameter or (2) a parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150608/FreshRSS-1.11.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Dec/3; https://www.exploit-db.com/exploits/45954/