deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-8445
Published: 2019-08-23
Description: Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-862
References: https://jira.atlassian.com/browse/JRASERVER-69778; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0840; https://jira.atlassian.com/browse/JRASERVER-69778
CVE: CVE-2019-8446
Published: 2019-08-23
Description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://jira.atlassian.com/browse/JRASERVER-69777; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839; https://jira.atlassian.com/browse/JRASERVER-69777
CVE: CVE-2019-8447
Published: 2019-08-23
Description: The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jira.atlassian.com/browse/JRASERVER-69776; https://jira.atlassian.com/browse/JRASERVER-69776
CVE: CVE-2019-15516
Published: 2019-08-23
Description: Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/cuberite/cuberite/pull/4341; https://github.com/cuberite/cuberite/pull/4341
CVE: CVE-2019-15517
Published: 2019-08-23
Description: jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/jc21/nginx-proxy-manager/compare/2.0.12...2.0.13; https://github.com/jc21/nginx-proxy-manager/pull/114; https://github.com/jc21/nginx-proxy-manager/compare/2.0.12...2.0.13
CVE: CVE-2019-15518
Published: 2019-08-23
Description: Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/swoole/swoole-src/compare/v4.2.12...v4.2.13; https://github.com/swoole/swoole-src/pull/2323; https://github.com/swoole/swoole-src/compare/v4.2.12...v4.2.13
CVE: CVE-2019-15519
Published: 2019-08-23
Description: Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Asymmetric-InfoSec/Power-Response/pull/156; https://github.com/Asymmetric-InfoSec/Power-Response/pull/156
CVE: CVE-2019-15520
Published: 2019-08-23
Description: comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/comelz/quark/pull/18; https://github.com/comelz/quark/pull/18
CVE: CVE-2019-15525
Published: 2019-08-23
Description: There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2019/08/26/1; https://softwarepublico.gov.br/gitlab/pw3270/principal/compare/efa4ab249821ec351ae[PII_REDACTED]43b8ca3c2ea...ff2b10fd56cf1fdae862b44bb0610e20e08de427; https://www.openwall.com/lists/oss-security/2019/08/26/1
CVE: CVE-2019-10746
Published: 2019-08-23
Description: mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFNIVG2XYFPZJY3DYYBJASZ7ZMKBMIJT/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC/; https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
CVE: CVE-2019-10747
Published: 2019-08-23
Description: set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292%40%3Cdev.drat.apache.org%3E; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/
CVE: CVE-2019-10750
Published: 2019-08-23
Description: deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://snyk.io/vuln/SNYK-JS-DEEPLY-451026; https://snyk.io/vuln/SNYK-JS-DEEPLY-451026
CVE: CVE-2019-10751
Published: 2019-08-23
Description: All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-601
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00022.html; https://github.com/jakubroztocil/httpie/releases/tag/1.0.3
CVE: CVE-2019-13013
Published: 2019-08-23
Description: Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264, CWE-862
References: https://obdev.at/cve/2019-13013-OSv2mEFD3z.html; https://obdev.at/cve/2019-13013-OSv2mEFD3z.html
CVE: CVE-2019-13014
Published: 2019-08-23
Description: Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264, CWE-459
References: https://obdev.at/cve/2019-13014-MzE24Ify4p.html; https://obdev.at/cve/2019-13014-MzE24Ify4p.html
CVE: CVE-2019-15526
Published: 2019-08-23
Description: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-7.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-7.pdf
CVE: CVE-2019-15527
Published: 2019-08-23
Description: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-6.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-6.pdf
CVE: CVE-2019-15528
Published: 2019-08-23
Description: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-5.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-5.pdf
CVE: CVE-2019-15529
Published: 2019-08-23
Description: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-1.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-1.pdf
CVE: CVE-2019-15530
Published: 2019-08-23
Description: An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-2.pdf; https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/823G-102B05-2.pdf
CVE: CVE-2019-15531
Published: 2019-08-23
Description: GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugs.gnunet.org/view.php?id=5846; https://lists.debian.org/debian-lts-announce/2019/08/msg00038.html; https://lists.debian.org/debian-lts-announce/2021/12/msg00016.html
CVE: CVE-2019-11654
Published: 2019-08-23
Description: Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://support.microfocus.com/kb/doc.php?id=7024061; https://support.microfocus.com/kb/doc.php?id=7024061
CVE: CVE-2019-15535
Published: 2019-08-23
Description: Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/hotosm/tasking-manager/issues/1731; https://github.com/hotosm/tasking-manager/releases/tag/v3.4.0; https://github.com/hotosm/tasking-manager/issues/1731
CVE: CVE-2019-15536
Published: 2019-08-23
Description: The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/YourAcclaim/block_acclaim/pull/18; https://github.com/YourAcclaim/block_acclaim/pull/18
CVE: CVE-2019-15537
Published: 2019-08-23
Description: The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CESNET/proxystatistics-simplesamlphp-module/pull/18; https://github.com/CESNET/proxystatistics-simplesamlphp-module/releases/tag/v3.1.0; https://github.com/CESNET/proxystatistics-simplesamlphp-module/pull/18
CVE: CVE-2019-1580
Published: 2019-08-23
Description: Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.paloaltonetworks.com/CVE-2019-1580; https://security.paloaltonetworks.com/CVE-2019-1580
CVE: CVE-2019-1581
Published: 2019-08-23
Description: A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-20
References: https://security.paloaltonetworks.com/CVE-2019-1581; https://security.paloaltonetworks.com/CVE-2019-1581
CVE: CVE-2019-1582
Published: 2019-08-23
Description: Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://security.paloaltonetworks.com/CVE-2019-1582; https://security.paloaltonetworks.com/CVE-2019-1582
CVE: CVE-2019-1583
Published: 2019-08-23
Description: Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to escalate privileges to that of another user. Active interaction with an affected component is required for the payload to execute on the victim.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://security.paloaltonetworks.com/CVE-2019-1583; https://security.paloaltonetworks.com/CVE-2019-1583
CVE: CVE-2019-5592
Published: 2019-08-23
Description: Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: https://fortiguard.com/advisory/FG-IR-19-145; https://fortiguard.com/advisory/FG-IR-19-145
CVE: CVE-2019-6698
Published: 2019-08-23
Description: Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://fortiguard.com/advisory/FG-IR-19-185; https://fortiguard.com/advisory/FG-IR-19-185
CVE: CVE-2019-7362
Published: 2019-08-23
Description: DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE: CVE-2019-7363
Published: 2019-08-23
Description: Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a use-after-free vulnerability, which may result in code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE: CVE-2019-7364
Published: 2019-08-23
Description: DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE: CVE-2018-13367
Published: 2019-08-23
Description: An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.com/advisory/FG-IR-18-173; https://fortiguard.com/advisory/FG-IR-18-173
CVE: CVE-2019-12400
Published: 2019-08-23
Description: In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://santuario.apache.org/secadv.data/CVE-2019-12400.asc?version=1&modificationDate=[PII_REDACTED]00&api=v2; https://access.redhat.com/errata/RHSA-2020:0804; https://access.redhat.com/errata/RHSA-2020:0805
CVE: CVE-2019-15092
Published: 2019-08-23
Description: The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1236
References: http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-Users-1.3.1-CSV-Injection.html; https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/; https://wpvulndb.com/vulnerabilities/9704
CVE: CVE-2019-5594
Published: 2019-08-23
Description: An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-19-140; https://fortiguard.com/advisory/FG-IR-19-140
CVE: CVE-2019-6695
Published: 2019-08-23
Description: Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://fortiguard.com/advisory/FG-IR-19-017; https://fortiguard.com/advisory/FG-IR-19-017
CVE: CVE-2016-6154
Published: 2019-08-23
Description: The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-601
References: https://www.sec-1.com/blog/2016/sec-1-advisory-reflected-cross-site-scripting-open-redirect-watchguard-fireware-v11-11; https://www.sec-1.com/blog/2016/sec-1-advisory-reflected-cross-site-scripting-open-redirect-watchguard-fireware-v11-11
CVE: CVE-2019-15538
Published: 2019-08-25
Description: An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fb254aa983bf190cfd685d40c64a480a9bafaee
CVE: CVE-2019-15540
Published: 2019-08-25
Description: filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00086.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00089.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00017.html
CVE: CVE-2016-10931
Published: 2019-08-26
Description: An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://rustsec.org/advisories/RUSTSEC-2016-0001.html; https://rustsec.org/advisories/RUSTSEC-2016-0001.html
CVE: CVE-2019-15478
Published: 2019-08-26
Description: Status Board 1.1.81 has reflected XSS via logic.ts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jameswlane/status-board/pull/949; https://github.com/jameswlane/status-board/pull/949
CVE: CVE-2019-15489
Published: 2019-08-26
Description: laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Laracommerce/laracom/pull/211; https://github.com/Laracommerce/laracom/pull/211
CVE: CVE-2019-15506
Published: 2019-08-26
Description: An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access/; http://help.kaseya.com/WebHelp/EN/RN/index.asp#VSAReleaseNotes.htm; http://dfdrconsulting.com/2019/cyber-security/cve-2019-15506-kaseya-vsa-critical-information-disclosure-unauthenticated-access/
CVE: CVE-2019-15532
Published: 2019-08-26
Description: CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gchq/CyberChef/commit/01f0625d6a177f9c5df9281f12a27c814c2d8bcf; https://github.com/gchq/CyberChef/compare/v8.31.1...v8.31.2; https://github.com/gchq/CyberChef/issues/539
CVE: CVE-2019-15534
Published: 2019-08-26
Description: Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/folio-org/raml-module-builder/pull/501; https://github.com/folio-org/raml-module-builder/pull/501
CVE: CVE-2019-15541
Published: 2019-08-26
Description: rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: https://github.com/ctz/rustls/commit/a93ee1abd2ab19ebe4bf9d684d56637ee54a6074; https://github.com/ctz/rustls/compare/cd66549...17ee52c; https://github.com/ctz/rustls/issues/285
CVE: CVE-2016-10932
Published: 2019-08-26
Description: An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-254
References: https://rustsec.org/advisories/RUSTSEC-2016-0002.html; https://rustsec.org/advisories/RUSTSEC-2016-0002.html
CVE: CVE-2016-10933
Published: 2019-08-26
Description: An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-254
References: https://rustsec.org/advisories/RUSTSEC-2016-0003.html; https://rustsec.org/advisories/RUSTSEC-2016-0003.html