deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15614
Published: 2019-01-23
Description: A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://downloads.avaya.com/css/P8/documents/101054317; https://downloads.avaya.com/css/P8/documents/101054317
CVE: CVE-2018-20245
Published: 2019-01-23
Description: The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c[PII_REDACTED]3927bbfb2a4cdc4cf73%40%3Cdev.airflow.apache.org%3E; https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c[PII_REDACTED]3927bbfb2a4cdc4cf73%40%3Cdev.airflow.apache.org%3E
CVE: CVE-2019-6706
Published: 2019-01-23
Description: Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://lua-users.org/lists/lua-l/2019-01/msg00039.html; http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html; https://access.redhat.com/security/cve/cve-2019-6706
CVE: CVE-2019-6707
Published: 2019-01-23
Description: PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/kk98kk0/exploit/issues/1; https://github.com/kk98kk0/exploit/issues/1
CVE: CVE-2019-6708
Published: 2019-01-23
Description: PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/kk98kk0/exploit/issues/2; https://github.com/kk98kk0/exploit/issues/2
CVE: CVE-2019-6713
Published: 2019-01-23
Description: app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.ttk7.cn/post-108.html; https://www.thinkcmf.com/download.html; http://www.ttk7.cn/post-108.html
CVE: CVE-2018-0187
Published: 2019-01-23
Description: A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this vulnerability by logging into the web interface on a vulnerable system. An exploit could allow an attacker to obtain confidential information for privileged accounts. This information could then be used to impersonate or negatively impact the privileged account on the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/106717; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-info-disclosure; http://www.securityfocus.com/bid/106717
CVE: CVE-2[PII_REDACTED]
Published: 2019-01-23
Description: A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jenkins.io/security/advisory/2018-10-10/#SECURITY-867; https://jenkins.io/security/advisory/2018-10-10/#SECURITY-867
CVE: CVE-2018-15455
Published: 2019-01-23
Description: A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of requests stored in the system's logging database. An attacker could exploit this vulnerability by sending malicious requests to the targeted system. An exploit could allow the attacker to conduct cross-site scripting attacks when an administrator views the logs in the Admin Portal.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106708; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-isel-xss; http://www.securityfocus.com/bid/106708
CVE: CVE-2018-15459
Published: 2019-01-23
Description: A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could exploit this vulnerability by authenticating to the device with an administrator account and sending a crafted HTTP request. A successful exploit could allow the attacker to create additional Admin accounts with different user roles. An attacker could then use these accounts to perform actions within their scope. The attacker would need valid Admin credentials for the device. This vulnerability cannot be exploited to add a Super Admin account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/106707; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-privilege; http://www.securityfocus.com/bid/106707
CVE: CVE-2019-1636
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/106718; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-teams; http://www.securityfocus.com/bid/106718
CVE: CVE-2019-6719
Published: 2019-01-23
Description: An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/iso_server/iso_server.c, as demonstrated by examples/server_example_goose/server_example_goose.c and examples/server_example_61400_25/server_example_61400_25.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/mz-automation/libiec61850/issues/111; https://github.com/mz-automation/libiec61850/issues/111
CVE: CVE-2019-1637
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/106704; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce; http://www.securityfocus.com/bid/106704
CVE: CVE-2019-1638
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/106704; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce; http://www.securityfocus.com/bid/106704
CVE: CVE-2019-1639
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/106704; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce; http://www.securityfocus.com/bid/106704
CVE: CVE-2019-1640
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/106704; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce; http://www.securityfocus.com/bid/106704
CVE: CVE-2019-1641
Published: 2019-01-23
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/106704; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-webex-rce; http://www.securityfocus.com/bid/106704
CVE: CVE-2019-1642
Published: 2019-01-23
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106714; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss; https://www.exploit-db.com/exploits/46263/
CVE: CVE-2019-1643
Published: 2019-01-23
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106702; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-cpi-xss; http://www.securityfocus.com/bid/106702
CVE: CVE-2019-1644
Published: 2019-01-23
Description: A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust system resources, resulting in a denial of service (DoS) condition. The vulnerability is due to improper resource management for UDP ingress packets. An attacker could exploit this vulnerability by sending a high rate of UDP packets to an affected system within a short period of time. A successful exploit could allow the attacker to exhaust available system resources, resulting in a DoS condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://www.securityfocus.com/bid/106709; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-iot-fnd-dos; http://www.securityfocus.com/bid/106709
CVE: CVE-2018-17625
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the setInterval() method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6438.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1094/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17626
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Validate events of TextBox objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6439.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1181/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17627
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the XFA mouseUp event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6455.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1218/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17628
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA setInterval method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6458.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1230/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17629
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of template objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6614.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1160/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17630
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the openPlayer method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6616.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1158/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17631
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the removeInstance event. The issue results from the lack of validation of the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6500.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1195/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17632
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the resolveNode event. The issue results from the lack of validation of the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6700.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1207/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17633
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the subject property of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6498.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1202/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-17634
Published: 2019-01-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the attachIcon property of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6499.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-18-1200/; https://www.foxitsoftware.com/support/security-bulletins.php