deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-19709
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19710
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19711
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19712
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19713
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106164; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106164
CVE: CVE-2018-19714
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19715
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106164; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106164
CVE: CVE-2018-19716
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106158; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106158
CVE: CVE-2018-19717
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19718
Published: 2019-01-18
Description: Adobe Connect versions 9.8.1 and earlier have a session token exposure vulnerability. Successful exploitation could lead to exposure of the privileges granted to a session.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106469; https://helpx.adobe.com/security/products/connect/apsb19-05.html; http://www.securityfocus.com/bid/106469
CVE: CVE-2018-19719
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106162; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106162
CVE: CVE-2018-19720
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]1 and earlier, 2[PII_REDACTED]6 and earlier version, 2[PII_REDACTED]5 and earlier version, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]6 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/106161; https://helpx.adobe.com/security/products/acrobat/apsb18-41.html; http://www.securityfocus.com/bid/106161
CVE: CVE-2018-19722
Published: 2019-01-18
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]2 and earlier, and 2[PII_REDACTED]2 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb18-30.html; https://helpx.adobe.com/security/products/acrobat/apsb18-30.html
CVE: CVE-2019-3906
Published: 2019-01-18
Description: Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/106552; https://www.tenable.com/security/research/tra-2019-01; http://www.securityfocus.com/bid/106552
CVE: CVE-2019-3907
Published: 2019-01-18
Description: Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-916
References: http://www.securityfocus.com/bid/106552; https://www.tenable.com/security/research/tra-2019-01; http://www.securityfocus.com/bid/106552
CVE: CVE-2019-3908
Published: 2019-01-18
Description: Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-259, CWE-798
References: http://www.securityfocus.com/bid/106552; https://www.tenable.com/security/research/tra-2019-01; http://www.securityfocus.com/bid/106552
CVE: CVE-2019-3909
Published: 2019-01-18
Description: Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: http://www.securityfocus.com/bid/106552; https://www.tenable.com/security/research/tra-2019-01; http://www.securityfocus.com/bid/106552
CVE: CVE-2019-3910
Published: 2019-01-18
Description: Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.
CVSS Score: 9.1 (CRITICAL)
References: https://www.tenable.com/security/research/tra-2019-02; https://www.tenable.com/security/research/tra-2019-02
CVE: CVE-2019-6488
Published: 2019-01-18
Description: The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/106671; https://security.gentoo.org/glsa/202006-04; https://sourceware.org/bugzilla/show_bug.cgi?id=24097
CVE: CVE-2018-20233
Published: 2019-01-18
Description: The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: http://www.securityfocus.com/bid/106661; https://ecosystem.atlassian.net/browse/UPM-5964; http://www.securityfocus.com/bid/106661
CVE: CVE-2017-18160
Published: 2019-01-18
Description: AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-310
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2017-18331
Published: 2019-01-18
Description: Improper access control on secure display buffers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 820, SD 820A, SD 835, SDA660
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2017-18332
Published: 2019-01-18
Description: Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX20, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2017-8276
Published: 2019-01-18
Description: Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-11279
Published: 2019-01-18
Description: Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-11284
Published: 2019-01-18
Description: Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660, SDM630, SDM660, SDX20
CVSS Score: 9.3 (CRITICAL)
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11288
Published: 2019-01-18
Description: Possible undefined behavior due to lack of size check in function for parameter segment_idx can lead to a read outside of the intended region in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDX24, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11993
Published: 2019-01-18
Description: Improper check while accessing the local memory stack on MQTT connection request can lead to buffer overflow in snapdragon wear in versions MDM9206, MDM9607
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11998
Published: 2019-01-18
Description: While processing a packet decode request in MQTT, Race condition can occur leading to an out-of-bounds access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 427, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11999
Published: 2019-01-18
Description: Improper input validation in trustzone can lead to denial of service in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 636, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM630, SDM660, SDX24
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-15784
Published: 2019-01-18
Description: Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.dell.com/support/article/us/en/04/sln315899/dsa-2019-001-dell-networking-os10-improper-certificate-validation-vulnerability?lang=en; https://www.dell.com/support/article/us/en/04/sln315899/dsa-2019-001-dell-networking-os10-improper-certificate-validation-vulnerability?lang=en
CVE: CVE-2018-3595
Published: 2019-01-18
Description: Anti-rollback can be bypassed in replay scenario during app loading due to improper error handling of RPMB writes in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX24, SXR1130
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-5867
Published: 2019-01-18
Description: Lack of checking input size can lead to buffer overflow In WideVine in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-5868
Published: 2019-01-18
Description: Lack of checking input size can lead to buffer overflow In WideVine in snapdragon automobile and snapdragon mobile in versions MSM8996AU, SD 425, SD 430, SD 450, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX24, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-5869
Published: 2019-01-18
Description: Improper input validation in the QTEE keymaster app can lead to invalid memory access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 800, SD 810
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-5879
Published: 2019-01-18
Description: Improper length check while processing an MQTT message can lead to heap overflow in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5880
Published: 2019-01-18
Description: Improper data length check while processing an event report indication can lead to a buffer overflow in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5881
Published: 2019-01-18
Description: Improper validation of buffer length checks in the lwm2m device management protocol can leads to a buffer overflow in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5915
Published: 2019-01-18
Description: Exception in Modem IP stack while processing IPv6 packet in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX20, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2019-3772
Published: 2019-01-18
Description: Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/106749; https://pivotal.io/security/cve-2019-3772; https://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2019-3773
Published: 2019-01-18
Description: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://pivotal.io/security/cve-2019-3773; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2019-3774
Published: 2019-01-18
Description: Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://lists.apache.org/thread.html/r01292194daa9ed3117b34dabec0c26929f6db13b9613fc144f720d52%40%3Cissues.servicemix.apache.org%3E; https://lists.apache.org/thread.html/r0153a08177fcfac7584c7b9ea3027f1e8f18f770126f905b9989190e%40%3Cissues.servicemix.apache.org%3E; https://lists.apache.org/thread.html/r08e7ddc354bdcbf95d88399f18b3d804865034f8bc706095e594b29f%40%3Cissues.servicemix.apache.org%3E
CVE: CVE-2018-18908
Published: 2019-01-20
Description: The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requests contain potentially sensitive information that could be useful to an attacker, such as the victim's Sky username.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://blog.sean-wright.com/sky/; https://blog.sean-wright.com/sky/