deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20720
Published: 2019-01-16
Description: ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reboot command in an SPA message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://search.abb.com/library/Download.aspx?DocumentID=1MRS758909&LanguageCode=en&DocumentPartId=&Action=Launch; http://www.securityfocus.com/bid/106641; http://search.abb.com/library/Download.aspx?DocumentID=1MRS758909&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-6439
Published: 2019-01-16
Description: examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106640; https://github.com/wolfSSL/wolfssl/issues/2032; http://www.securityfocus.com/bid/106640
CVE: CVE-2016-10737
Published: 2019-01-16
Description: Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/40650; https://www.exploit-db.com/exploits/40650
CVE: CVE-2016-10738
Published: 2019-01-16
Description: Zenbership v107 has CSRF via admin/cp-functions/event-add.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/40620; https://www.exploit-db.com/exploits/40620
CVE: CVE-2019-6440
Published: 2019-01-16
Description: Zemana AntiMalware before 3.0.658 Beta mishandles update logic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: https://www.zemana.com/whats-new?ProductID=2; https://www.zemana.com/whats-new?ProductID=2
CVE: CVE-2019-6442
Published: 2019-01-16
Description: An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://dumpco.re/blog/ntpsec-bugs; https://dumpco.re/bugs/ntpsec-authed-oobwrite; https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
CVE: CVE-2019-6443
Published: 2019-01-16
Description: An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://dumpco.re/blog/ntpsec-bugs; https://dumpco.re/bugs/ntpsec-oobread1; https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
CVE: CVE-2019-6444
Published: 2019-01-16
Description: An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://dumpco.re/blog/ntpsec-bugs; https://dumpco.re/bugs/ntpsec-oobread2; https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
CVE: CVE-2019-6445
Published: 2019-01-16
Description: An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://dumpco.re/blog/ntpsec-bugs; https://dumpco.re/bugs/ntpsec-authed-npe; https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
CVE: CVE-2019-6446
Published: 2019-01-16
Description: An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html
CVE: CVE-2019-6261
Published: 2019-01-16
Description: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106638; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-stored-xss-in-com-contact; http://www.securityfocus.com/bid/106638
CVE: CVE-2019-6262
Published: 2019-01-16
Description: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106638; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-stored-xss-issue-in-the-global-configuration-help-url; http://www.securityfocus.com/bid/106638
CVE: CVE-2019-6263
Published: 2019-01-16
Description: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106638; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-stored-xss-issue-in-the-global-configuration-textfilter-settings; https://www.exploit-db.com/exploits/46200/
CVE: CVE-2019-6264
Published: 2019-01-16
Description: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106638; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-stored-xss-in-mod-banners; http://www.securityfocus.com/bid/106638
CVE: CVE-2018-20721
Published: 2019-01-16
Description: URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/uriparser/uriparser/blob/master/ChangeLog; https://github.com/uriparser/uriparser/commit/cef25028de5ff872c2e1f0a6c562eb3ea9ecbce4; https://lists.debian.org/debian-lts-announce/2019/02/msg00028.html
CVE: CVE-2019-6447
Published: 2019-01-16
Description: The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/163303/ES-File-Explorer-4.1.9.7.4-Arbitrary-File-Read.html; https://github.com/fs0c131y/ESFileExplorerOpenPortVuln; https://twitter.com/fs0c131y/status/[PII_REDACTED]13508352
CVE: CVE-2015-9276
Published: 2019-01-16
Description: SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-smartermail-stored-xss-in-emails-v2.pdf; https://www.nccgroup.trust/uk/our-research/smartermail-stored-xss-in-emails/; https://www.smartertools.com/smartermail/release-notes/13
CVE: CVE-2015-9277
Published: 2019-01-16
Description: MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://web.archive.org/web/[PII_REDACTED]3628/http://www.mailenable.com/Standard-ReleaseNotes.txt; https://www.nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf; https://www.nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable/
CVE: CVE-2015-9278
Published: 2019-01-16
Description: MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: https://web.archive.org/web/[PII_REDACTED]3628/http://www.mailenable.com/Standard-ReleaseNotes.txt; https://www.nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf; https://www.nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable/
CVE: CVE-2015-9279
Published: 2019-01-16
Description: MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3628/http://www.mailenable.com/Standard-ReleaseNotes.txt; https://www.nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf; https://www.nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable/
CVE: CVE-2015-9280
Published: 2019-01-16
Description: MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611
References: https://web.archive.org/web/[PII_REDACTED]3628/http://www.mailenable.com/Standard-ReleaseNotes.txt; https://www.nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf; https://www.nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable/
CVE: CVE-2018-20723
Published: 2019-01-16
Description: A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2018-20724
Published: 2019-01-16
Description: A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2018-20725
Published: 2019-01-16
Description: A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2018-20726
Published: 2019-01-16
Description: A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2019-6455
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function rec_mset_elem_destroy() in the file rec-mset.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6456
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the file rec-fex.c of librec.a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6457
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_aggregate_reg_new in rec-aggregate.c in librec.a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6458
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_buf_new in rec-buf.c when called from rec_parse_rset in rec-parser.c in librec.a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6459
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_extract_type in rec-utils.c in librec.a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6460
Published: 2019-01-16
Description: An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_field_set_name() in the file rec-field.c in librec.a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/TeamSeri0us/pocs/tree/master/recutils; https://github.com/TeamSeri0us/pocs/tree/master/recutils
CVE: CVE-2019-6461
Published: 2019-01-16
Description: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/TeamSeri0us/pocs/tree/master/gerbv; https://gitlab.freedesktop.org/cairo/cairo/issues/352; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2019-6462
Published: 2019-01-16
Description: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/TeamSeri0us/pocs/tree/master/gerbv; https://gitlab.freedesktop.org/cairo/cairo/issues/353; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2018-3125
Published: 2019-01-16
Description: Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Security (SQL Logger)). The supported version that is affected is 14.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Merchandising System accessible data as well as unauthorized read access to a subset of Oracle Retail Merchandising System accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106571; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2018-3303
Published: 2019-01-16
Description: Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponent: EM Console). Supported versions that are affected are 13.2 and 13.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data as well as unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106618; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2018-3304
Published: 2019-01-16
Description: Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.0 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVSS Score: 6.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106615; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2018-3305
Published: 2019-01-16
Description: Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data as well as unauthorized read access to a subset of Oracle Application Testing Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing Suite. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVSS Score: 6.3 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106615; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2018-3309
Published: 2019-01-16
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is prior to 5.2.22. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 8.2 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106572
CVE: CVE-2018-3311
Published: 2019-01-16
Description: Vulnerability in the Oracle Retail Xstore Payment component of Oracle Retail Applications (subcomponent: Security). The supported version that is affected is 3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Payment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Retail Xstore Payment accessible data as well as unauthorized update, insert or delete access to some of Oracle Retail Xstore Payment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Retail Xstore Payment. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 8.6 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106566; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2019-2395
Published: 2019-01-16
Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). The supported version that is affected is 10.3.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.0 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
CVSS Score: 5.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106585; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html
CVE: CVE-2019-2396
Published: 2019-01-16
Description: Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
CVSS Score: 4.7 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html; http://www.securityfocus.com/bid/106620; http://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html