deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10511
Published: 2019-12-12
Description: Possibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10520
Published: 2019-12-12
Description: An unprivileged application can allocate GPU memory by calling memory allocation ioctl function and can exhaust all the memory which results in out of memory in Snapdragon Mobile, Snapdragon Voice & Music in QCS405, SD 210/SD 212/SD 205, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://source.android.com/security/bulletin/pixel/2019-11-01; https://source.android.com/security/bulletin/pixel/2019-11-01
CVE: CVE-2019-10530
Published: 2019-12-12
Description: Lack of check of data truncation on user supplied data in kernel leads to buffer overflow in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2019-11-01; https://source.android.com/security/bulletin/pixel/2019-11-01
CVE: CVE-2019-10545
Published: 2019-12-12
Description: Null pointer dereference issue in kernel due to missing check related to LLC support in GPU in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS605, SDM670, SDM710, SM6150, SM7150, SM8150
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10555
Published: 2019-12-12
Description: Buffer overflow can occur due to usage of wrong datatype and missing length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10559
Published: 2019-12-12
Description: Accessing data buffer beyond the available data while parsing ogg clip can lead to null-pointer dereference and then memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8939, MSM8953, MSM8996, MSM8996AU, Nicobar, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-476, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10571
Published: 2019-12-12
Description: Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCN7605, QCS405, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10592
Published: 2019-12-12
Description: Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum mode count in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-10618
Published: 2019-12-12
Description: Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCA6390
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2288
Published: 2019-12-12
Description: Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996, MSM8996AU, MSM8998, QCA8081, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2310
Published: 2019-12-12
Description: Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Frame body in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM8150
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2319
Published: 2019-12-12
Description: HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2320
Published: 2019-12-12
Description: Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2321
Published: 2019-12-12
Description: Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ4019, IPQ8074, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA8081, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2337
Published: 2019-12-12
Description: While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device to shutdown in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-2338
Published: 2019-12-12
Description: Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, MSM8998, QCS404, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 7.1 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin
CVE: CVE-2019-13927
Published: 2019-12-12
Description: A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 (All firmware versions < V6.00.320), Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 (All firmware versions < V6.00.320), Desigo PX automation controllers PXC22.1-E.D, PXC36-E.D, PXC36.1-E.D with activated web server (All firmware versions < V6.00.320). The device contains a vulnerability that could allow an attacker to cause a denial of service condition on the device's web server by sending a specially crafted HTTP message to the web server port (tcp/80). The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device's web service. While the device itself stays operational, the web server responds with HTTP status code 404 (Not found) to any further request. A reboot is required to recover the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-472, CWE-668
References: https://cert-portal.siemens.com/productcert/pdf/ssa-898181.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-898181.pdf
CVE: CVE-2019-13945
Published: 2019-12-12
Description: A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family < V4.x (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family V4.x (incl. SIPLUS variants) (All versions with Function State (FS) < 11), SIMATIC S7-200 SMART CPU CR20s (6ES7 288-1CR20-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR30s (6ES7 288-1CR30-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR40 (6ES7 288-1CR40-0AA0) (All versions <= V2.2.2 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU CR40s (6ES7 288-1CR40-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU CR60 (6ES7 288-1CR60-0AA0) (All versions <= V2.2.2 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU CR60s (6ES7 288-1CR60-0AA1) (All versions <= V2.3.0 and Function State (FS) <= 3), SIMATIC S7-200 SMART CPU SR20 (6ES7 288-1SR20-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 11), SIMATIC S7-200 SMART CPU SR30 (6ES7 288-1SR30-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU SR40 (6ES7 288-1SR40-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 10), SIMATIC S7-200 SMART CPU SR60 (6ES7 288-1SR60-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 12), SIMATIC S7-200 SMART CPU ST20 (6ES7 288-1ST20-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 9), SIMATIC S7-200 SMART CPU ST30 (6ES7 288-1ST30-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 9), SIMATIC S7-200 SMART CPU ST40 (6ES7 288-1ST40-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU ST60 (6ES7 288-1ST60-0AA0) (All versions <= V2.5.0 and Function State (FS) <= 8), SIMATIC S7-200 SMART CPU family (All versions). There is an access mode used during manufacturing of the affected devices that allows additional diagnostic functionality. The security vulnerability could be exploited by an attacker with physical access to the UART interface during boot process.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-749
References: https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf
CVE: CVE-2019-14849
Published: 2019-12-12
Description: A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-201, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14849
CVE: CVE-2019-15930
Published: 2019-12-12
Description: Intesync Solismed 3.3sp allows Clickjacking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15931
Published: 2019-12-12
Description: Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15932
Published: 2019-12-12
Description: Intesync Solismed 3.3sp has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-862
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15933
Published: 2019-12-12
Description: Intesync Solismed 3.3sp has SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15934
Published: 2019-12-12
Description: Intesync Solismed 3.3sp has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15935
Published: 2019-12-12
Description: Intesync Solismed 3.3sp has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-15936
Published: 2019-12-12
Description: Intesync Solismed 3.3sp allows Insecure File Upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://bishopfox.com; https://know.bishopfox.com/advisories/solismed-critical; https://www.bishopfox.com/blog/news-category/advisories/
CVE: CVE-2019-16246
Published: 2019-12-12
Description: Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/solismed-critical; https://www.solismed.com/
CVE: CVE-2019-17358
Published: 2019-12-12
Description: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
CVE: CVE-2019-17428
Published: 2019-12-12
Description: An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/solismed-critical; https://www.solismed.com/
CVE: CVE-2019-18345
Published: 2019-12-12
Description: A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html; https://gitlab.com/davical-project/davical/blob/master/ChangeLog; https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
CVE: CVE-2019-19198
Published: 2019-12-12
Description: The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155615/WordPress-Scoutnet-Kalender-1.1.0-Cross-Site-Scripting.html; https://wordpress.org/plugins/scoutnet-kalender/#developers; https://wpvulndb.com/vulnerabilities/9969
CVE: CVE-2019-19247
Published: 2019-12-12
Description: Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2).
CVSS Score: 7.8 (HIGH)
References: https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client; https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client
CVE: CVE-2019-19248
Published: 2019-12-12
Description: Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2).
CVSS Score: 7.8 (HIGH)
References: https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client; https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client
CVE: CVE-2019-4606
Published: 2019-12-12
Description: IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168298; https://www.ibm.com/support/pages/node/1128063; https://exchange.xforce.ibmcloud.com/vulnerabilities/168298
CVE: CVE-2019-19750
Published: 2019-12-12
Description: minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://github.com/minerstat/minerstat-os/commit/487ebd652dc9dc81120809effb2ddb3f66fc5f14; https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html; https://github.com/minerstat/minerstat-os/commit/487ebd652dc9dc81120809effb2ddb3f66fc5f14