deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19590
Published: 2019-12-05
Description: In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-416
References: https://github.com/radareorg/radare2/issues/15543; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRQXCOVFWZIIMAZIAAFAVQGZOS7LGHXP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQTOWEDFXDTGTD6D4NHRB4FUURQSTTEN/
CVE: CVE-2019-19596
Published: 2019-12-05
Description: GitBook through 2.6.9 allows XSS via a local .md file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ianxtianxt/gitbook-xss/; https://github.com/ianxtianxt/gitbook-xss/
CVE: CVE-2019-19589
Published: 2019-12-05
Description: The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-436, CWE-436
References: https://sejalivre.org/usando-arquivos-polyglot-para-distribuir-malwares/; https://wordpress.org/plugins/pdf-embedder/#developers; https://sejalivre.org/usando-arquivos-polyglot-para-distribuir-malwares/
CVE: CVE-2019-19597
Published: 2019-12-05
Description: D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10135; https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/
CVE: CVE-2019-19598
Published: 2019-12-05
Description: D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to the value stored in the device's /var/hnap/timestamp file, the request will pass the HNAP_AUTH check function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10135; https://chung96vn.wordpress.com/2019/11/15/d-link-dap-1860-vulnerabilities/
CVE: CVE-2019-19601
Published: 2019-12-05
Description: OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/pkubowicz/opendetex/issues/60; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF3RU3VMLP5SS4MXAEKQKAGTSPN3KMHJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KFIIVMCMPMORLPJBOULTPGJUH626DHFU/
CVE: CVE-2019-19317
Published: 2019-12-05
Description: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-681
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/sqlite/sqlite/commit/522ebfa7cee96fb325a22ea3a2464a63485886a8; https://github.com/sqlite/sqlite/commit/73bacb7f93eab9f4bd5a65cbc4ae242acf63c9e3
CVE: CVE-2019-19602
Published: 2019-12-05
Description: fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.kernel.org/show_bug.cgi?id=205663; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c4bd853abcea95eccc167a7d7fd5f1a5f47b98
CVE: CVE-2013-0163
Published: 2019-12-05
Description: OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://access.redhat.com/security/cve/cve-2013-0163; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0163; https://access.redhat.com/security/cve/cve-2013-0163
CVE: CVE-2019-14910
Published: 2019-12-05
Description: A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-305, CWE-592, CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14910; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14910
CVE: CVE-2019-17437
Published: 2019-12-05
Description: An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9.0 versions prior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280, CWE-287
References: https://securityadvisories.paloaltonetworks.com/Home/Detail/159; https://securityadvisories.paloaltonetworks.com/Home/Detail/159
CVE: CVE-2019-18180
Published: 2019-12-05
Description: Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2013-0243
Published: 2019-12-05
Description: haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/01/30/6; https://access.redhat.com/security/cve/cve-2013-0243; https://security-tracker.debian.org/tracker/CVE-2013-0243
CVE: CVE-2[PII_REDACTED]
Published: 2019-12-05
Description: Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
CVSS Score: 2.6 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/kubernetes/kubernetes/issues/85867; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK/; https://github.com/kubernetes/kubernetes/issues/85867
CVE: CVE-2019-11255
Published: 2019-12-05
Description: Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://access.redhat.com/errata/RHSA-2019:4054; https://access.redhat.com/errata/RHSA-2019:4096; https://access.redhat.com/errata/RHSA-2019:4099
CVE: CVE-2019-15897
Published: 2019-12-05
Description: beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typically not exposed to external networks).
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/155573/BeeGFS-7.1.3-Privilege-Escalation.html; https://seclists.org/bugtraq/2019/Dec/7; https://www.hpcsec.com/2019/12/04/cve-2019-15897/
CVE: CVE-2019-19007
Published: 2019-12-05
Description: Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a related issue to CVE-2019-17600.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://medium.com/%40rsantos_14778/1500b407dccc; https://medium.com/%40rsantos_14778/1500b407dccc
CVE: CVE-2019-19008
Published: 2019-12-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-19363. Reason: This candidate is a reservation duplicate of CVE-2019-19363. Notes: All CVE users should reference CVE-2019-19363 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-19594
Published: 2019-12-05
Description: reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://ia-informatica.com/it/CVE-2019-19594; https://ia-informatica.com/it/CVE-2019-19594
CVE: CVE-2019-19595
Published: 2019-12-05
Description: reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://ia-informatica.com/it/CVE-2019-19595; https://ia-informatica.com/it/CVE-2019-19595
CVE: CVE-2019-3690
Published: 2019-12-05
Description: The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-59, CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html; https://bugzilla.suse.com/show_bug.cgi?id=1150734; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html
CVE: CVE-2013-0283
Published: 2019-12-05
Description: Katello: Username in Notification page has cross site scripting
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2013-0283; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0283; https://access.redhat.com/security/cve/cve-2013-0283
CVE: CVE-2013-0326
Published: 2019-12-05
Description: OpenStack nova base images permissions are world readable
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://access.redhat.com/security/cve/cve-2013-0326; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0326; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-0326
CVE: CVE-2019-7183
Published: 2019-12-05
Description: This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-27; https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE: CVE-2019-7184
Published: 2019-12-05
Description: This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-27; https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE: CVE-2019-7185
Published: 2019-12-05
Description: This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-27; https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE: CVE-2019-7192
Published: 2019-12-05
Description: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html; https://www.qnap.com/zh-tw/security-advisory/nas-201911-25; http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE: CVE-2019-7193
Published: 2019-12-05
Description: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html; https://www.qnap.com/zh-tw/security-advisory/nas-201911-25; http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE: CVE-2019-7194
Published: 2019-12-05
Description: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html; https://www.qnap.com/zh-tw/security-advisory/nas-201911-25; http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE: CVE-2019-7195
Published: 2019-12-05
Description: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html; https://www.qnap.com/zh-tw/security-advisory/nas-201911-25; http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE: CVE-2012-1104
Published: 2019-12-05
Description: A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2012/03/05/7; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1104; https://gitlab.vsb.cz/kal0178/sixmon/blob/b18bcde090dc38fc968a0b1e38d1dab08b8c369e/web/lib/CAS/CAS-1.3.5/docs/ChangeLog
CVE: CVE-2019-17387
Published: 2019-12-05
Description: An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through arbitrary code execution on Windows, Linux, and macOS.
CVSS Score: 7.8 (HIGH)
References: https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html; https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/; https://immersivelabs.com/blog/
CVE: CVE-2019-17388
Published: 2019-12-05
Description: Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html; https://immersivelabs.com/2019/12/04/aviatrix-vpn-client-vulnerability/; https://immersivelabs.com/blog/
CVE: CVE-2019-18381
Published: 2019-12-05
Description: Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-346
References: https://support.symantec.com/us/en/article.SYMSA1499.html; https://support.symantec.com/us/en/article.SYMSA1499.html
CVE: CVE-2019-19545
Published: 2019-12-05
Description: Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of issue that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-346
References: https://support.symantec.com/us/en/article.SYMSA1499.html; https://support.symantec.com/us/en/article.SYMSA1499.html
CVE: CVE-2019-19546
Published: 2019-12-05
Description: Norton Password Manager, prior to 6.6.2.5, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
CVSS Score: 6.5 (MEDIUM)
References: https://support.symantec.com/us/en/article.SYMSA1499.html; https://support.symantec.com/us/en/article.SYMSA1499.html
CVE: CVE-2019-5098
Published: 2019-12-05
Description: An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. A specially crafted pixel shader can cause out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0890; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0890
CVE: CVE-2012-1105
Published: 2019-12-05
Description: An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2012/03/05/7; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1105; https://gitlab.vsb.cz/kal0178/sixmon/blob/b18bcde090dc38fc968a0b1e38d1dab08b8c369e/web/lib/CAS/CAS-1.3.5/docs/ChangeLog
CVE: CVE-2019-16769
Published: 2019-12-05
Description: The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx; https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx
CVE: CVE-2019-16768
Published: 2019-12-05
Description: In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-209, CWE-209
References: https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f; https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h; https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f
CVE: CVE-2019-16770
Published: 2019-12-05
Description: In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994; https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html; https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994
CVE: CVE-2019-19609
Published: 2019-12-05
Description: The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html; http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html; https://bittherapy.net/post/strapi-framework-remote-code-execution/
CVE: CVE-2012-1114
Published: 2019-12-05
Description: A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html
CVE: CVE-2012-1115
Published: 2019-12-05
Description: A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089297.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089313.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089328.html