deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-4219
Published: 2019-06-06
Description: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 159228.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159228; https://www.ibm.com/support/docview.wss?uid=ibm10886065; https://exchange.xforce.ibmcloud.com/vulnerabilities/159228
CVE: CVE-2019-4257
Published: 2019-06-06
Description: IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159945; https://www.ibm.com/support/docview.wss?uid=ibm10882478; https://exchange.xforce.ibmcloud.com/vulnerabilities/159945
CVE: CVE-2019-12763
Published: 2019-06-07
Description: The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is readable by any application.
CVSS Score: 7.5 (HIGH)
References: https://hansesecure.de/2019/05/vulnerability-security-camera-cz-storage/; https://hansesecure.de/2019/05/vulnerability-security-camera-cz-storage/
CVE: CVE-2019-12771
Published: 2019-06-07
Description: Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/VolControl.cgi OK= substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Thinstation/thinstation/issues/427; https://github.com/Thinstation/thinstation/issues/427
CVE: CVE-2019-6530
Published: 2019-06-07
Description: Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows, which may lead to remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/108683; https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02; https://www.zerodayinitiative.com/advisories/ZDI-19-565/
CVE: CVE-2019-6532
Published: 2019-06-07
Description: Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://www.securityfocus.com/bid/108683; https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02; https://www.zerodayinitiative.com/advisories/ZDI-19-566/
CVE: CVE-2018-5265
Published: 2019-06-07
Description: Ubiquiti EdgeOS 1.9.1 on EdgeRouter Lite devices allows remote attackers to execute arbitrary code with admin credentials, because /opt/vyatta/share/vyatta-cfg/templates/system/static-host-mapping/host-name/node.def does not sanitize the 'alias' or 'ips' parameter for shell metacharacters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.red4sec.com/cve/edgerouter_lite.txt; https://www.red4sec.com/cve/edgerouter_lite.txt
CVE: CVE-2018-5798
Published: 2019-06-07
Description: This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cloudera.com; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com
CVE: CVE-2018-6185
Published: 2019-06-07
Description: In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of an encryption zone key and network access to the Key Trustee KMS to make those calls against known encryption zone keys. This can result in the recovery of a previously deleted, but not purged, key (undelete) or the deletion of a key in active use (purge) resulting in loss of access to encrypted HDFS data.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: https://www.cloudera.com; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com
CVE: CVE-2019-12477
Published: 2019-06-07
Description: Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html; https://drive.google.com/file/d/1ZVHn_bPE-3kqYd2D-3AJpXZdd4dlmzVh/view?usp=sharing; http://packetstormsecurity.com/files/153191/Supra-Smart-Cloud-TV-Remote-File-Inclusion.html
CVE: CVE-2019-4066
Published: 2019-06-07
Description: IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force ID: 157011.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157011; https://www.ibm.com/support/docview.wss?uid=ibm10879381; https://exchange.xforce.ibmcloud.com/vulnerabilities/157011
CVE: CVE-2019-4067
Published: 2019-06-07
Description: IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157012; https://www.ibm.com/support/docview.wss?uid=ibm10880213; https://exchange.xforce.ibmcloud.com/vulnerabilities/157012
CVE: CVE-2019-4068
Published: 2019-06-07
Description: IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157013; https://www.ibm.com/support/docview.wss?uid=ibm10880229; https://exchange.xforce.ibmcloud.com/vulnerabilities/157013
CVE: CVE-2019-4069
Published: 2019-06-07
Description: IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157014; https://www.ibm.com/support/docview.wss?uid=ibm10879953; https://exchange.xforce.ibmcloud.com/vulnerabilities/157014
CVE: CVE-2019-4070
Published: 2019-06-07
Description: IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157015.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/157015; https://www.ibm.com/support/docview.wss?uid=ibm10879943; https://exchange.xforce.ibmcloud.com/vulnerabilities/157015
CVE: CVE-2019-8282
Published: 2019-06-07
Description: Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-300, CWE-346
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-029-gemalto-admin-control-center-uses-cleartext-communication-with-www3-safenet-inc-com/
CVE: CVE-2019-8283
Published: 2019-06-07
Description: Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1004, CWE-732
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/06/05/klcert-19-030-hasplm-cookie-without-httponly-attribute/
CVE: CVE-2018-20014
Published: 2019-06-07
Description: In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin/CClientThread.cpp CClientThread::GetFileHashAndMetadata NULL pointer dereference, leading to shutting down the client application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.urbackup.org/client_changelog.html; https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2018-20014; http://www.urbackup.org/client_changelog.html
CVE: CVE-2018-20091
Published: 2019-06-07
Description: An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html; https://www.cloudera.com/products/data-science-and-engineering/data-science-workbench.html; https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE: CVE-2018-20135
Published: 2019-06-07
Description: Samsung Galaxy Apps before 4.4.01.7 allows modification of the hostname used for load balancing on installations of applications through a man-in-the-middle attack. An attacker may trick Galaxy Apps into using an arbitrary hostname for which the attacker can provide a valid SSL certificate, and emulate the API of the app store to modify existing apps at installation time. The specific flaw involves an HTTP method to obtain the load-balanced hostname that enforces SSL only after obtaining a hostname from the load balancer, and a missing app signature validation in the application XML. An attacker can exploit this vulnerability to achieve Remote Code Execution on the device. The Samsung ID is SVE-2018-12071.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://security.samsungmobile.com/securityUpdate.smsb; https://www.adyta.pt/en/2019/01/29/writeup-samsung-app-store-rce-via-mitm-2/; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-20523
Published: 2019-06-07
Description: Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: http://packetstormsecurity.com/files/163796/Xiaomi-10.2.4.g-Information-Disclosure.html; https://sec.xiaomi.com; https://vishwarajbhattrai.wordpress.com/2019/03/22/content-provider-injection-in-xiaomi-stock-browser
CVE: CVE-2018-5264
Published: 2019-06-07
Description: Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://www.red4sec.com/cve/unifi.txt; https://www.red4sec.com/cve/unifi.txt
CVE: CVE-2019-12774
Published: 2019-06-07
Description: A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mogozobo.com/?p=3476; https://www.mogozobo.com/?p=3476
CVE: CVE-2019-12775
Published: 2019-06-07
Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.mogozobo.com/?p=3476; https://www.mogozobo.com/?p=3476
CVE: CVE-2019-12776
Published: 2019-06-07
Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocate_revB scripts copies the hardcoded key to the root user's authorized_keys file, enabling anyone with the associated private key to gain remote root access to all affected products.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.mogozobo.com/?p=3476; https://www.mogozobo.com/?p=3476
CVE: CVE-2019-12777
Published: 2019-06-07
Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.mogozobo.com/?p=3476; https://www.mogozobo.com/?p=3476
CVE: CVE-2018-19451
Published: 2019-06-07
Description: A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://www.securityfocus.com/bid/108692; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/108692
CVE: CVE-2018-19452
Published: 2019-06-07
Description: A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free location and requires different JavaScript code for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108692; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/108692
CVE: CVE-2018-19461
Published: 2019-06-07
Description: admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://i.3001.net/uploads/Up_imgs/20181117-95a316d46f9a46dda7c48e541777d1fc.png%21small; http://i.3001.net/uploads/Up_imgs/20181117-ce3d7d[PII_REDACTED]1393bfda0d6f9d07.png%21small; https://github.com/novysodope/empireCMS7.5
CVE: CVE-2018-19462
Published: 2019-06-07
Description: admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://i.3001.net/uploads/Up_imgs/20181118-2c996e3b89d19c9c9e6761ef67fd6d5c.png%21small; http://i.3001.net/uploads/Up_imgs/20[PII_REDACTED]2261fa34cad723bc7d8b8ca2cd17.png; http://i.3001.net/uploads/Up_imgs/20181118-ca3d385ac6cf2d231da185b4bb844bad.png%21small
CVE: CVE-2018-19465
Published: 2019-06-07
Description: Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/holychang/maccms8/blob/master/README.md; https://www.maccms.com/down.html; https://github.com/holychang/maccms8/blob/master/README.md
CVE: CVE-2018-19800
Published: 2019-06-07
Description: aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html; https://github.com/aubio/aubio/blob/0.4.9/ChangeLog
CVE: CVE-2018-19801
Published: 2019-06-07
Description: aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html; https://github.com/aubio/aubio/blob/0.4.9/ChangeLog
CVE: CVE-2018-19802
Published: 2019-06-07
Description: aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00003.html
CVE: CVE-2018-19860
Published: 2019-06-07
Description: Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://seclists.org/fulldisclosure/2019/Aug/11; http://seclists.org/fulldisclosure/2019/Jul/22; https://seclists.org/bugtraq/2019/Aug/21
CVE: CVE-2018-19999
Published: 2019-06-07
Description: The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://seclists.org/fulldisclosure/2019/May/46; https://www.themissinglink.com.au/security-advisories-cve-2018-19999; https://seclists.org/fulldisclosure/2019/May/46
CVE: CVE-2019-3477
Published: 2019-06-07
Description: Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://help.serena.com/doc_center/sbm/ver11_4_2/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_4_2/sbm_release_notes.htm
CVE: CVE-2019-10160
Published: 2019-06-07
Description: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f[PII_REDACTED]8f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-172, CWE-522
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://access.redhat.com/errata/RHSA-2019:1587
CVE: CVE-2019-12598
Published: 2019-06-07
Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE: CVE-2019-12599
Published: 2019-06-07
Description: SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE: CVE-2019-12600
Published: 2019-06-07
Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE: CVE-2019-12601
Published: 2019-06-07
Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE: CVE-2018-10690
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10691
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8