deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13268
Published: 2019-08-27
Description: TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13269
Published: 2019-08-27
Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-13270
Published: 2019-08-27
Description: Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://orenlab.sise.bgu.ac.il/publications/CrossRouter; https://www.usenix.org/system/files/woot19-paper_ovadia.pdf; https://orenlab.sise.bgu.ac.il/publications/CrossRouter
CVE: CVE-2019-15700
Published: 2019-08-27
Description: public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/frappe/frappe/pull/8262; https://github.com/frappe/frappe/pull/8262
CVE: CVE-2019-15701
Published: 2019-08-27
Description: components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an Active Directory with a GPO containing JavaScript in its name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/BloodHoundAD/BloodHound/issues/267; https://github.com/BloodHoundAD/BloodHound/issues/267
CVE: CVE-2019-15702
Published: 2019-08-27
Description: In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/RIOT-OS/RIOT/issues/12086; https://github.com/RIOT-OS/RIOT/issues/12086
CVE: CVE-2011-5329
Published: 2019-08-28
Description: The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/redirection/#developers; https://wordpress.org/plugins/redirection/#developers
CVE: CVE-2012-6717
Published: 2019-08-28
Description: The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/redirection/#developers; https://wordpress.org/plugins/redirection/#developers
CVE: CVE-2012-6718
Published: 2019-08-28
Description: The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/sharebar/#developers; https://wordpress.org/plugins/sharebar/#developers
CVE: CVE-2012-6719
Published: 2019-08-28
Description: The sharebar plugin before 1.2.2 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/sharebar/#developers; https://wordpress.org/plugins/sharebar/#developers
CVE: CVE-2015-9353
Published: 2019-08-28
Description: The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wordpress.org/plugins/gigpress/#developers; https://wordpress.org/plugins/gigpress/#developers
CVE: CVE-2015-9354
Published: 2019-08-28
Description: The gigpress plugin before 2.3.11 for WordPress has XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gigpress/#developers; https://wordpress.org/plugins/gigpress/#developers
CVE: CVE-2015-9355
Published: 2019-08-28
Description: The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/two-factor-authentication/#developers; https://wordpress.org/plugins/two-factor-authentication/#developers
CVE: CVE-2015-9356
Published: 2019-08-28
Description: The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/; https://wordpress.org/plugins/wp-vipergb/#developers; https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/
CVE: CVE-2015-9357
Published: 2019-08-28
Description: The akismet plugin before 3.1.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/akismet/#developers; https://wordpress.org/plugins/akismet/#developers
CVE: CVE-2015-9358
Published: 2019-08-28
Description: The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/feedwordpress/#developers; https://wordpress.org/plugins/feedwordpress/#developers
CVE: CVE-2015-9360
Published: 2019-08-28
Description: The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://updraftplus.com/new-security-vulnerability-found-across-significant-numbers-of-wordpress-plugins-including-updraftplus/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9361
Published: 2019-08-28
Description: The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://www.barrykooij.com/several-security-updates-released/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9362
Published: 2019-08-28
Description: The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.barrykooij.com/several-security-updates-released/; https://www.barrykooij.com/several-security-updates-released/
CVE: CVE-2015-9363
Published: 2019-08-28
Description: iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9364
Published: 2019-08-28
Description: 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9365
Published: 2019-08-28
Description: Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9366
Published: 2019-08-28
Description: Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9367
Published: 2019-08-28
Description: Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9368
Published: 2019-08-28
Description: Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2017-18593
Published: 2019-08-28
Description: The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/updraftplus/#developers; https://wordpress.org/plugins/updraftplus/#developers
CVE: CVE-2019-15294
Published: 2019-08-28
Description: An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are logged in cleartext to the Command_centre.log file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://security.gallagher.com/CVE-2019-15294; https://security.gallagher.com/security-advisories; https://security.gallagher.com/CVE-2019-15294
CVE: CVE-2019-15713
Published: 2019-08-28
Description: The my-calendar plugin before 3.1.10 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/my-calendar/#developers; https://wordpress.org/plugins/my-calendar/#developers
CVE: CVE-2019-15714
Published: 2019-08-28
Description: cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/entropic-dev/entropic/issues/251; https://github.com/entropic-dev/entropic/issues/251
CVE: CVE-2015-9369
Published: 2019-08-28
Description: Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9370
Published: 2019-08-28
Description: Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9371
Published: 2019-08-28
Description: Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9372
Published: 2019-08-28
Description: Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9373
Published: 2019-08-28
Description: PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9374
Published: 2019-08-28
Description: Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9375
Published: 2019-08-28
Description: Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9376
Published: 2019-08-28
Description: iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9377
Published: 2019-08-28
Description: iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9378
Published: 2019-08-28
Description: iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9379
Published: 2019-08-28
Description: iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://ithemes.com/coordinated-wordpress-plugin-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2015-9359
Published: 2019-08-28
Description: The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html; https://jetpack.com/2015/04/20/jetpack-3-4-3-coordinated-security-update/; https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
CVE: CVE-2019-15716
Published: 2019-08-28
Description: WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72; https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0; https://github.com/wtfutil/wtf/issues/517
CVE: CVE-2019-10058
Published: 2019-08-28
Description: Various Lexmark products have Incorrect Access Control.
CVSS Score: 9.1 (CRITICAL)
References: http://support.lexmark.com/index?page=content&id=TE922&locale=EN&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE922&locale=EN&userlocale=EN_US
CVE: CVE-2019-10383
Published: 2019-08-28
Description: A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/08/28/4; https://access.redhat.com/errata/RHSA-2019:2789; https://access.redhat.com/errata/RHSA-2019:3144
CVE: CVE-2019-10384
Published: 2019-08-28
Description: Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/08/28/4; https://access.redhat.com/errata/RHSA-2019:2789; https://access.redhat.com/errata/RHSA-2019:3144
CVE: CVE-2019-10390
Published: 2019-08-28
Description: A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2019/08/28/4; https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1294; http://www.openwall.com/lists/oss-security/2019/08/28/4
CVE: CVE-2019-10391
Published: 2019-08-28
Description: Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/08/28/4; https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1512; http://www.openwall.com/lists/oss-security/2019/08/28/4
CVE: CVE-2019-13189
Published: 2019-08-28
Description: In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.contentsecurity.com.au/security-advisory-knowage-cross-site-scripting; https://blog.contentsecurity.com.au/security-advisory-knowage-cross-site-scripting
CVE: CVE-2019-13348
Published: 2019-08-28
Description: In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://blog.contentsecurity.com.au/knowage-password-disclosure; https://blog.contentsecurity.com.au/knowage-password-disclosure
CVE: CVE-2019-9934
Published: 2019-08-28
Description: Various Lexmark products have Incorrect Access Control (issue 1 of 2).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: http://support.lexmark.com/index?page=content&id=TE924&locale=en&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE924&locale=en&userlocale=EN_US
CVE: CVE-2019-9935
Published: 2019-08-28
Description: Various Lexmark products have Incorrect Access Control (issue 2 of 2).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: http://support.lexmark.com/index?page=content&id=TE924&locale=EN&userlocale=EN_US; http://support.lexmark.com/index?page=content&id=TE924&locale=EN&userlocale=EN_US
CVE: CVE-2019-15230
Published: 2019-08-28
Description: LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/239-librenms-v1-54-xss; https://www.sevenlayers.com/index.php/239-librenms-v1-54-xss