deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9585
Published: 2019-02-11
Description: In nfc_ncif_proc_get_routing of nfc_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-117554809.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9586
Published: 2019-02-11
Description: In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that package verification is turned off and remains off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116754444.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9587
Published: 2019-02-11
Description: In savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is possible unauthorized access to files within the contact app due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Android ID: A-113597344.
CVSS Score: 7.3 (HIGH)
CWE: CWE-552
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9588
Published: 2019-02-11
Description: In avdt_scb_hdl_report of avdt_scb_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-111450156.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9589
Published: 2019-02-11
Description: In ieee802_11_rx_wnmsleep_req of wnm_ap.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi driver with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-111893132.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9590
Published: 2019-02-11
Description: In add_attr of sdp_discovery.c in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-115900043.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9591
Published: 2019-02-11
Description: In bta_hh_ctrl_dat_act of bta_hh_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116108738.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9592
Published: 2019-02-11
Description: In mca_ccb_hdl_rsp of mca_cact.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116319076.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9593
Published: 2019-02-11
Description: In llcp_dlc_proc_i_pdu of llcp_dlc.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116722267.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2018-9594
Published: 2019-02-11
Description: In llcp_link_proc_agf_pdu of llcp_link.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116791157.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: http://www.securityfocus.com/bid/106495; https://source.android.com/security/bulletin/2019-01-01.html; http://www.securityfocus.com/bid/106495
CVE: CVE-2019-3923
Published: 2019-02-12
Description: Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/tns-2019-01; https://www.tenable.com/security/tns-2019-01
CVE: CVE-2019-5595
Published: 2019-02-12
Description: In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized before return from system calls, potentially allowing some kernel data used in the system call to be exposed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-19:01.syscall.asc; https://exchange.xforce.ibmcloud.com/vulnerabilities/156624; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:01.syscall.asc
CVE: CVE-2019-5596
Published: 2019-02-12
Description: In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/155790/FreeBSD-fd-Privilege-Escalation.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:02.fd.asc; http://packetstormsecurity.com/files/155790/FreeBSD-fd-Privilege-Escalation.html
CVE: CVE-2019-7753
Published: 2019-02-12
Description: Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Verytops/verydows/issues/11; https://github.com/Verytops/verydows/issues/11
CVE: CVE-2018-20781
Published: 2019-02-12
Description: In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919; https://bugzilla.gnome.org/show_bug.cgi?id=781486; https://github.com/huntergregal/mimipenguin
CVE: CVE-2019-6527
Published: 2019-02-12
Description: PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE: CVE-2019-6533
Published: 2019-02-12
Description: Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE: CVE-2019-6549
Published: 2019-02-12
Description: An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) through FTP.
CVSS Score: 7.2 (HIGH)
CWE: CWE-312, CWE-522
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-05
CVE: CVE-2019-7739
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is intended behavior. However, it might be unexpected for the user because the configuration dialog lacks an additional message to explain this.
CVSS Score: 6.1 (MEDIUM)
References: http://www.securityfocus.com/bid/107015; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-additional-warning-in-the-global-configuration-textfilter-settings; http://www.securityfocus.com/bid/107015
CVE: CVE-2019-7740
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-xss-issue-in-core-js-writedynalist; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-xss-issue-in-core-js-writedynalist
CVE: CVE-2019-7741
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-stored-xss-issue-in-the-global-configuration-help-url-2; https://developer.joomla.org/security-centre/[PII_REDACTED]4-core-stored-xss-issue-in-the-global-configuration-help-url-2
CVE: CVE-2019-7742
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-browserside-mime-type-sniffing-causes-xss-attack-vectors; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-browserside-mime-type-sniffing-causes-xss-attack-vectors
CVE: CVE-2019-7743
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-917
References: http://www.securityfocus.com/bid/107050; https://developer.joomla.org/security-centre/[PII_REDACTED]6-core-implement-the-typo3-phar-stream-wrapper; http://www.securityfocus.com/bid/107050
CVE: CVE-2019-7744
Published: 2019-02-12
Description: An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-lack-of-url-filtering-in-various-core-components; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-lack-of-url-filtering-in-various-core-components
CVE: CVE-2019-1688
Published: 2019-02-12
Description: A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server. The vulnerability is due to a fault in the password management system of NAE. An attacker could exploit this vulnerability by authenticating with the default administrator password via the CLI of an affected server. A successful exploit could allow the attacker to view potentially sensitive information or bring the server down, causing a DoS condition. This vulnerability affects Cisco Network Assurance Engine (NAE) Release 3.0(1). The default password condition only affects new installations of Release 3.0(1).
CVSS Score: 7.1 (HIGH)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/107010; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190212-nae-dos; http://www.securityfocus.com/bid/107010
CVE: CVE-2018-19645
Published: 2019-02-12
Description: An Authentication Bypass issue exists in Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm; http://help.serena.com/doc_center/sbm/ver11_5/sbm_release_notes.htm
CVE: CVE-2018-5499
Published: 2019-02-12
Description: ATTO FibreBridge 7500N firmware version 2.95 is susceptible to a vulnerability which allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-7550
Published: 2019-02-12
Description: In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.criticalstart.com/2019/02/information-disclosure-in-jforum-2-1-x-syntax/; https://www.criticalstart.com/2019/02/information-disclosure-in-jforum-2-1-x-syntax/
CVE: CVE-2018-15336
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15337
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15338
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15339
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15340
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15341
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15342
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15343
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15344
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15345
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15346
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15347
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15348
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-15349
Published: 2019-02-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2017-0938
Published: 2019-02-12
Description: Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v6-0-7-Has-Been-Released/ba-p/2056522; https://community.ubnt.com/t5/airMAX-Updates-Blog/airOS-v8-3-2-Has-Been-Released/ba-p/2049215; https://hackerone.com/reports/221625
CVE: CVE-2018-19018
Published: 2019-02-12
Description: An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-824, CWE-824
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01; https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE: CVE-2018-19020
Published: 2019-02-12
Description: When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the application to read a value outside of an array.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01; https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01
CVE: CVE-2019-8308
Published: 2019-02-12
Description: Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
CVSS Score: 8.2 (HIGH)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html; https://access.redhat.com/errata/RHSA-2019:0375; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922059
CVE: CVE-2019-6537
Published: 2019-02-13
Description: Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/106861; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-03; http://www.securityfocus.com/bid/106861
CVE: CVE-2019-6539
Published: 2019-02-13
Description: Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/106861; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-03; http://www.securityfocus.com/bid/106861
CVE: CVE-2019-6541
Published: 2019-02-13
Description: A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: http://www.securityfocus.com/bid/106861; https://ics-cert.us-cert.gov/advisories/ICSA-19-036-03; http://www.securityfocus.com/bid/106861
CVE: CVE-2018-20253
Published: 2019-02-13
Description: In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://research.checkpoint.com/extracting-code-execution-from-winrar/; https://www.win-rar.com/whatsnew.html; https://research.checkpoint.com/extracting-code-execution-from-winrar/
CVE: CVE-2019-6543
Published: 2019-02-13
Description: AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01; https://www.exploit-db.com/exploits/46342/; https://www.tenable.com/security/research/tra-2019-04
CVE: CVE-2019-6545
Published: 2019-02-13
Description: AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-99
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-036-01; https://www.exploit-db.com/exploits/46342/; https://www.tenable.com/security/research/tra-2019-04