deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7409
Published: 2019-05-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page, (2) gbs, (3) side, (4) id, (5) imgid, (6) cat, or (7) orderby parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://metamorfosec.com/Files/Advisories/METS-2019-001-Multiple_XSS_Vulnerabilities_in_ProfileDesign_CMS_v6.0.2.5.txt; https://www.vegadesign.net/?side=pdcmd_endringslogg; https://metamorfosec.com/Files/Advisories/METS-2019-001-Multiple_XSS_Vulnerabilities_in_ProfileDesign_CMS_v6.0.2.5.txt
CVE: CVE-2019-7411
Published: 2019-05-13
Description: Multiple stored cross-site scripting (XSS) in the MyThemeShop Launcher plugin 1.0.8 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via fields as follows: (1) Title, (2) Favicon, (3) Meta Description, (4) Subscribe Form (Name field label, Last name field label, Email field label), (5) Contact Form (Name field label and Email field label), and (6) Social Links (Facebook Page URL, Twitter Page URL, Instagram Page URL, YouTube Page URL, Linkedin Page URL, Google+ Page URL, RSS URL).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://metamorfosec.com/Files/Advisories/METS-2019-002-Multiple_Stored_XSS_Vulnerabilities_in_the_MyThemeShop_Launcher_plugin_v1.0.8_for_WordPress.txt; https://wpvulndb.com/vulnerabilities/9275; https://metamorfosec.com/Files/Advisories/METS-2019-002-Multiple_Stored_XSS_Vulnerabilities_in_the_MyThemeShop_Launcher_plugin_v1.0.8_for_WordPress.txt
CVE: CVE-2019-8350
Published: 2019-05-13
Description: The Simple - Better Banking application 2.45.0 through 2.45.3 (fixed in 2.46.0) for Android was affected by an information disclosure vulnerability that leaked the user's password to the keyboard autocomplete functionality. Third-party Android keyboards that capture the password may store this password in cleartext, or transmit the password to third-party services for keyboard customization purposes. A compromise of any datastore that contains keyboard autocompletion caches would result in the disclosure of the user's Simple Bank password.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-522
References: https://www.bishopfox.com/news/2019/02/simple-better-banking-android-v-2-45-0-2-45-3-sensitive-information-disclosure/; https://www.simple.com/policies/security; https://www.bishopfox.com/news/2019/02/simple-better-banking-android-v-2-45-0-2-45-3-sensitive-information-disclosure/
CVE: CVE-2019-11429
Published: 2019-05-13
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152696/CentOS-Web-Panel-Domain-Field-Cross-Site-Scripting.html; https://CentOS-WebPanel.com; https://www.exploit-db.com/exploits/46784/
CVE: CVE-2019-12047
Published: 2019-05-13
Description: Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by child_process.exec and the "<img src=# onerror='eval(new Buffer(" substring.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/getgridea/gridea/issues/105; https://github.com/getgridea/gridea/issues/105
CVE: CVE-2019-3684
Published: 2019-05-13
Description: SUSE Manager until version 4.0.7 and Uyuni until commit 1b426ad5ed0a7191a6fb46bb83e98ae4b99a5ade created world-readable swap files on systems that don't have a swap already configured and don't have btrfs as filesystem
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://bugzilla.suse.com/show_bug.cgi?id=1131954; https://bugzilla.suse.com/show_bug.cgi?id=1131954
CVE: CVE-2015-9287
Published: 2019-05-13
Description: Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://doi.org/10.1007/978-3-030-03251-7_1; https://github.com/grymer/CVE; https://doi.org/10.1007/978-3-030-03251-7_1
CVE: CVE-2018-4014
Published: 2019-05-13
Description: An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0685; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0685
CVE: CVE-2018-4016
Published: 2019-05-13
Description: An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0687; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0687
CVE: CVE-2018-4017
Published: 2019-05-13
Description: An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can potentially be used to connect to the device. An attacker can connect to the AP to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0688; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0688
CVE: CVE-2018-4018
Published: 2019-05-13
Description: An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689
CVE: CVE-2018-4023
Published: 2019-05-13
Description: An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0695; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0695
CVE: CVE-2018-4024
Published: 2019-05-13
Description: An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a null pointer dereference, resulting in a device reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0696; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0696
CVE: CVE-2018-4025
Published: 2019-05-13
Description: An exploitable denial-of-service vulnerability exists in the XML_GetRawEncJpg Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an invalid memory dereference, resulting in a device reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0697; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0697
CVE: CVE-2018-4026
Published: 2019-05-13
Description: An exploitable denial-of-service vulnerability exists in the XML_GetScreen Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted set of packets can cause an invalid memory dereference, resulting in a device reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0698; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0698
CVE: CVE-2018-4027
Published: 2019-05-13
Description: An exploitable denial-of-service vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause a semaphore deadlock, which prevents the device from receiving any physical or network inputs. An attacker can send a specially crafted packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-662
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0699; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0699
CVE: CVE-2018-4028
Published: 2019-05-13
Description: An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server could allow an attacker to overwrite the root directory of the server, resulting in a denial of service. An attacker can send an HTTP POST request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0700; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0700
CVE: CVE-2018-4029
Published: 2019-05-13
Description: An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. A specially crafted packet can cause an unlimited and arbitrary write to memory, resulting in code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0701; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0701
CVE: CVE-2019-4259
Published: 2019-05-13
Description: A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160011; https://www.ibm.com/support/docview.wss?uid=ibm10883568; https://exchange.xforce.ibmcloud.com/vulnerabilities/160011
CVE: CVE-2019-7690
Published: 2019-05-13
Description: In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://github.com/yogeshshe1ke/CVE/blob/master/2019-7690/mobaxterm_exploit.py; https://github.com/yogeshshe1ke/CVE/blob/master/2019-7690/mobaxterm_exploit.py
CVE: CVE-2019-10050
Published: 2019-05-13
Description: A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://lists.openinfosecfoundation.org/pipermail/oisf-announce/; https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/; https://lists.openinfosecfoundation.org/pipermail/oisf-announce/
CVE: CVE-2019-3702
Published: 2019-05-13
Description: A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://atomic111.github.io/article/lifesize-icon-remote-code-execution; https://www.lifesize.com/en/video-conferencing-cameras; https://www.sva.de/solutions/it-security.html
CVE: CVE-2019-8342
Published: 2019-05-13
Description: A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-9726
Published: 2019-05-13
Description: Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://atomic111.github.io/article/homematic-ccu3-fileread; https://atomic111.github.io/article/homematic-ccu3-fileread
CVE: CVE-2019-9727
Published: 2019-05-13
Description: Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GUI password hashes of GUI users. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://atomic111.github.io/article/homematic-ccu3-unauthenticated-password-hash-disclosure; https://atomic111.github.io/article/homematic-ccu3-unauthenticated-password-hash-disclosure
CVE: CVE-2019-11680
Published: 2019-05-13
Description: KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image.
CVSS Score: 9.8 (CRITICAL)
References: https://www.konakart.com/downloads/patch-releases/; https://www.konakart.com/downloads/patch-releases/
CVE: CVE-2019-1649
Published: 2019-05-13
Description: A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that support hardware-based Secure Boot functionality. The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation. An attacker with elevated privileges and access to the underlying operating system that is running on the affected device could exploit this vulnerability by writing a modified firmware image to the FPGA. A successful exploit could either cause the device to become unusable (and require a hardware replacement) or allow tampering with the Secure Boot verification process, which under some circumstances may allow the attacker to install and boot a malicious software image. An attacker will need to fulfill all the following conditions to attempt to exploit this vulnerability: Have privileged administrative access to the device. Be able to access the underlying operating system running on the device; this can be achieved either by using a supported, documented mechanism or by exploiting another vulnerability that would provide an attacker with such access. Develop or have access to a platform-specific exploit. An attacker attempting to exploit this vulnerability across multiple affected platforms would need to research each one of those platforms and then develop a platform-specific exploit. Although the research process could be reused across different platforms, an exploit developed for a given hardware platform is unlikely to work on a different hardware platform.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-284, CWE-667
References: http://www.securityfocus.com/bid/108350; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190513-secureboot; https://www.kb.cert.org/vuls/id/400865
CVE: CVE-2019-7217
Published: 2019-05-13
Description: Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request to check the otp code. No authentication is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: http://www.sk-it.com/en/cve.html; http://www.sk-it.com/en/cve.html
CVE: CVE-2019-7218
Published: 2019-05-13
Description: Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's otp physical token or virtual app (like google authenticator) is able to bypass the first authentication phase (username/password mechanism) and log-in using username/otp combination only (phase 2 of 2FA).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: http://www.sk-it.com/en/cve.html; http://www.sk-it.com/en/cve.html
CVE: CVE-2018-16139
Published: 2019-05-13
Description: Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html; https://www.0x90.zone/web/xss/2019/02/01/XSS-Bibliosoft.html
CVE: CVE-2018-18912
Published: 2019-05-13
Description: An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been made to forum.ghp upon creating a new topic in the forums, which allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/notkisi/CVE-s/blob/master/CVE-2018-18912.py; https://github.com/notkisi/CVE-s/blob/master/CVE-2018-18912.py
CVE: CVE-2019-11600
Published: 2019-05-13
Description: A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/152806/OpenProject-8.3.1-SQL-Injection.html; http://seclists.org/fulldisclosure/2019/May/7; https://groups.google.com/forum/#%21msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ
CVE: CVE-2019-12083
Published: 2019-05-13
Description: The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. If the `Error::type_id` method is overridden then any type can be safely cast to any other type, causing memory safety vulnerabilities in safe code (e.g., out-of-bounds write or read). Code that does not manually implement Error::type_id is unaffected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html
CVE: CVE-2019-1862
Published: 2019-05-13
Description: A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the Web UI and then submitting that form. A successful exploit could allow the attacker to run arbitrary commands on the device with root privileges, which may lead to complete system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108331; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190513-webui; https://www.kb.cert.org/vuls/id/400865
CVE: CVE-2018-16136
Published: 2019-05-13
Description: An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multiple forms unwillingly by a victim.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html; https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html
CVE: CVE-2018-16137
Published: 2019-05-13
Description: An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html; https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html
CVE: CVE-2018-16138
Published: 2019-05-13
Description: An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html; https://www.0x90.zone/web/multiple/2019/02/01/Multiple-Vulnerabilities-IPBrick.html
CVE: CVE-2019-10053
Published: 2019-05-13
Description: An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-191
References: https://lists.openinfosecfoundation.org/pipermail/oisf-announce/; https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/; https://lists.openinfosecfoundation.org/pipermail/oisf-announce/
CVE: CVE-2019-8951
Published: 2019-05-13
Description: An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote attacker to redirect users to an arbitrary URL. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.70.0056 and newer; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; fixed versions: 7.5; 3.70.0056).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0401bt-cve-2019-8951_security_advisory_vrm_open_redirect.pdf; https://psirt.bosch.com; https://psirt.bosch.com/Advisory/BOSCH-2019-0401.html