deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7567
Published: 2019-02-07
Description: An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/caokang/waimai/issues/10; https://github.com/caokang/waimai/issues/10
CVE: CVE-2019-7568
Published: 2019-02-07
Description: An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/baijiacms/baijiacmsV4/issues/2; https://github.com/baijiacms/baijiacmsV4/issues/2
CVE: CVE-2019-7569
Published: 2019-02-07
Description: An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/millken/doyocms/issues/1; https://github.com/millken/doyocms/issues/1
CVE: CVE-2019-7570
Published: 2019-02-07
Description: A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://blog.csdn.net/yangfan0502/article/details/86189065; https://blog.csdn.net/yangfan0502/article/details/86189065
CVE: CVE-2019-7572
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7573
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7574
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7575
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7576
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7577
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7578
Published: 2019-02-07
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2018-1666
Published: 2019-02-07
Description: IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/144892; https://www.ibm.com/support/docview.wss?uid=ibm10744205; https://exchange.xforce.ibmcloud.com/vulnerabilities/144892
CVE: CVE-2019-4008
Published: 2019-02-07
Description: API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155626.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: http://www.securityfocus.com/bid/106961; https://exchange.xforce.ibmcloud.com/vulnerabilities/155626; https://www.ibm.com/support/docview.wss?uid=ibm10869772
CVE: CVE-2019-7535
Published: 2019-02-07
Description: index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gist.github.com/nenf/2f16cd547c2afe166d1cb3f88f18bf81; https://gist.github.com/nenf/2f16cd547c2afe166d1cb3f88f18bf81
CVE: CVE-2019-7580
Published: 2019-02-07
Description: ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/shadowsock5/ThinkCMF-5.0.190111/blob/master/README.md; https://xz.aliyun.com/t/3997; https://github.com/shadowsock5/ThinkCMF-5.0.190111/blob/master/README.md
CVE: CVE-2019-7581
Published: 2019-02-07
Description: The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876.
CVSS Score: 8.8 (HIGH)
CWE: CWE-770
References: https://github.com/libming/libming/issues/173; https://github.com/libming/libming/issues/173
CVE: CVE-2019-7582
Published: 2019-02-07
Description: The readBytes function in util/read.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-770
References: https://github.com/libming/libming/issues/172; https://github.com/libming/libming/issues/172
CVE: CVE-2019-7585
Published: 2019-02-07
Description: An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/caokang/waimai/issues/11; https://github.com/caokang/waimai/issues/11
CVE: CVE-2019-1677
Published: 2019-02-07
Description: A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack against the application. The vulnerability is due to insufficient validation of the application input parameters. An attacker could exploit this vulnerability by sending a malicious request to the Webex Meetings application through an intent. A successful exploit could allow the attacker to execute script code in the context of the Webex Meetings application. Versions prior to 11.7.0.236 are affected.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106933; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-webex-andro-xss; http://www.securityfocus.com/bid/106933
CVE: CVE-2019-3704
Published: 2019-02-07
Description: VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configured in sudores, a local authenticated malicious user could potentially execute arbitrary OS commands as root by exploiting this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/106954; https://seclists.org/fulldisclosure/2019/Feb/8; http://www.securityfocus.com/bid/106954
CVE: CVE-2019-7587
Published: 2019-02-07
Description: Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://c3tsec.wordpress.com/2019/01/12/sql-injection-in-bo-blog-wind-cms/; https://c3tsec.wordpress.com/2019/01/12/sql-injection-in-bo-blog-wind-cms/
CVE: CVE-2019-1675
Published: 2019-02-07
Description: A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker could exploit this vulnerability by guessing the account name and password to access the CLI. A successful exploit could allow the attacker to reboot the device repeatedly, creating a denial of service (DoS) condition. It is not possible to change the configuration or view sensitive data with this account. Versions prior to DNAC1.2.8 are affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/106944; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-aas-creds; http://www.securityfocus.com/bid/106944
CVE: CVE-2019-1678
Published: 2019-02-07
Description: A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application users who are paired with a Session Initiation Protocol (SIP) endpoint. The vulnerability is due to improper validation of coSpaces configuration parameters. An attacker could exploit this vulnerability by inserting crafted strings in specific coSpace parameters. An exploit could allow the attacker to prevent clients from joining a conference call in the affected coSpace. Versions prior to 2.4.3 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/106943; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-cms-dos; http://www.securityfocus.com/bid/106943
CVE: CVE-2019-1660
Published: 2019-02-07
Description: A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to a lack of proper access and authentication controls on the affected TMS software. An attacker could exploit this vulnerability by gaining access to internal, trusted networks to send crafted SOAP calls to the affected device. If successful, an exploit could allow the attacker to access system management tools. Under normal circumstances, this access should be prohibited.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-264
References: http://www.securityfocus.com/bid/106918; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-tms-soap; http://www.securityfocus.com/bid/106918
CVE: CVE-2019-1679
Published: 2019-02-07
Description: A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to trigger an HTTP request from an affected server to an arbitrary host. This type of attack is commonly referred to as server-side request forgery (SSRF). The vulnerability is due to insufficient access controls for the REST API of Cisco Expressway Series and Cisco TelePresence VCS. An attacker could exploit this vulnerability by submitting a crafted HTTP request to the affected server. Versions prior to XC4.3.4 are affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://www.securityfocus.com/bid/106940; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-rest-api-ssrf; http://www.securityfocus.com/bid/106940
CVE: CVE-2019-1680
Published: 2019-02-07
Description: A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to view a malicious URL. A successful exploit could allow the attacker to inject arbitrary text into the user's browser. The attacker could use the content injection to conduct spoofing attacks. Versions prior than 3.0.9 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-20
References: http://www.securityfocus.com/bid/106939; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-webex-injection; http://www.securityfocus.com/bid/106939
CVE: CVE-2018-1296
Published: 2019-02-07
Description: In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106764; https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E; http://www.securityfocus.com/bid/106764
CVE: CVE-2018-1340
Published: 2019-02-07
Description: Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: http://www.securityfocus.com/bid/106768; https://lists.apache.org/thread.html/af1632e13dd9acf[PII_REDACTED]cae9143cbb10fdd2f9bb0832a690979%40%3Cannounce.guacamole.apache.org%3E; http://www.securityfocus.com/bid/106768
CVE: CVE-2019-1661
Published: 2019-02-07
Description: A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106920; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-tms-xss; http://www.securityfocus.com/bid/106920
CVE: CVE-2019-1670
Published: 2019-02-07
Description: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this vulnerability by convincing a user to click a specific link. A successful exploit could allow the attacker to submit arbitrary requests to the affected system via a web browser with the privileges of the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106919; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-cuic-xss; http://www.securityfocus.com/bid/106919
CVE: CVE-2019-1671
Published: 2019-02-07
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106927; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-fmc-xss; http://www.securityfocus.com/bid/106927
CVE: CVE-2017-17834
Published: 2019-02-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017.  Notes: none
CVE: CVE-2019-6139
Published: 2019-02-07
Description: Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below, apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://help.forcepoint.com/security/CVE/CVE-2019-6139.html; https://help.forcepoint.com/security/CVE/CVE-2019-6139.html
CVE: CVE-2019-7401
Published: 2019-02-08
Description: NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a denial of service (router process crash) or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://hg.nginx.org/unit/file/tip/CHANGES; http://mailman.nginx.org/pipermail/unit/2019-February/000113.html; http://unit.nginx.org/CHANGES.txt
CVE: CVE-2019-7628
Published: 2019-02-08
Description: Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in files/api_key_expire_mail.py; disabling that job is also a viable solution. (E-mailing a substring of the API key was an attempted, but rejected, solution.)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://pagure.io/pagure/c/9905fb1e[PII_REDACTED]6b6ab1d414d2baa230af0a; https://pagure.io/pagure/issue/4230; https://pagure.io/pagure/issue/4252
CVE: CVE-2019-6242
Published: 2019-02-08
Description: Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time
CVSS Score: 7.2 (HIGH)
CWE: CWE-522
References: https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2; https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2
CVE: CVE-2019-7632
Published: 2019-02-08
Description: LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the support/mtusize.php mtu_size parameter. The lifesize default password for the cli account may sometimes be used for authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=22113; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=22113
CVE: CVE-2019-7635
Published: 2019-02-08
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7636
Published: 2019-02-08
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7637
Published: 2019-02-08
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7638
Published: 2019-02-08
Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html
CVE: CVE-2019-7639
Published: 2019-02-08
Description: An issue was discovered in gsi-openssh-server 7.9p1 on Fedora 29. If PermitPAMUserChange is set to yes in the /etc/gsissh/sshd_config file, logins succeed with a valid username and an incorrect password, even though a failure entry is recorded in the /var/log/messages file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1673802; https://bugzilla.redhat.com/show_bug.cgi?id=1673802
CVE: CVE-2018-18364
Published: 2019-02-08
Description: Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential attacker attempts to execute unexpected code on your machine. This occurs via placement of a potentially foreign file (DLL) that the attacker then attempts to run via a linked application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/106684; https://support.symantec.com/en_US/article.SYMSA1474.html; http://www.securityfocus.com/bid/106684