deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-9688
Published: 2019-10-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-8085
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8086
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8087
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8088
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2019-8234
Published: 2019-10-25
Description: Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-48.html
CVE: CVE-2013-4658
Published: 2019-10-25
Description: Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/; https://www.ise.io/wp-content/uploads/2017/06/soho_defcon21.pdf
CVE: CVE-2013-4848
Published: 2019-10-25
Description: TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://vuldb.com/?id.10495; https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/
CVE: CVE-2019-14451
Published: 2019-10-25
Description: RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.repetier-server.com/knowledgebase/security-advisory/; https://www.repetier-server.com/manuals/0.91/index.html; https://www.repetier-server.com/knowledgebase/security-advisory/
CVE: CVE-2019-16265
Published: 2019-10-25
Description: CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-09_LCDS-319.pdf; https://www.codesys.com; https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-09_LCDS-319.pdf
CVE: CVE-2019-4036
Published: 2019-10-25
Description: IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156159; https://www.ibm.com/support/pages/node/1072704; https://exchange.xforce.ibmcloud.com/vulnerabilities/156159
CVE: CVE-2019-4394
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232.
CVSS Score: 2.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162232; https://www.ibm.com/support/pages/node/1097301; https://exchange.xforce.ibmcloud.com/vulnerabilities/162232
CVE: CVE-2019-4395
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162233; https://www.ibm.com/support/pages/node/1097175; https://exchange.xforce.ibmcloud.com/vulnerabilities/162233
CVE: CVE-2019-4396
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 162236.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162236; https://www.ibm.com/support/pages/node/1096354; https://exchange.xforce.ibmcloud.com/vulnerabilities/162236
CVE: CVE-2019-4399
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 162260.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162260; https://www.ibm.com/support/pages/node/1097307; https://exchange.xforce.ibmcloud.com/vulnerabilities/162260
CVE: CVE-2019-4400
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162261.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162261; https://www.ibm.com/support/pages/node/1077129; https://exchange.xforce.ibmcloud.com/vulnerabilities/162261
CVE: CVE-2019-4461
Published: 2019-10-25
Description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of content. This would allow the attacker to perform further attacks, such as Web Cache poisoning, cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 163682.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163682; https://www.ibm.com/support/pages/node/1072684; https://exchange.xforce.ibmcloud.com/vulnerabilities/163682
CVE: CVE-2019-13525
Published: 2019-10-25
Description: In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data, which can be accessed without authentication over the network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-19-297-02; https://www.us-cert.gov/ics/advisories/icsa-19-297-02
CVE: CVE-2019-13546
Published: 2019-10-25
Description: In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host application user to break-out from the containment of the application and access unauthorized resources from the Windows operating system as the limited-access Windows user. Due to potential Windows vulnerabilities, it may be possible for additional attack methods to be used to escalate privileges on the operating system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://www.us-cert.gov/ics/advisories/icsma-19-297-01; https://www.us-cert.gov/ics/advisories/icsma-19-297-01
CVE: CVE-2019-13549
Published: 2019-10-25
Description: Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on and off and setting the temperature set point, can be modified without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: http://seclists.org/fulldisclosure/2019/Oct/46; https://www.us-cert.gov/ics/advisories/icsa-19-297-01; http://seclists.org/fulldisclosure/2019/Oct/46
CVE: CVE-2019-13553
Published: 2019-10-25
Description: Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://seclists.org/fulldisclosure/2019/Oct/45; https://www.us-cert.gov/ics/advisories/icsa-19-297-01; http://seclists.org/fulldisclosure/2019/Oct/45
CVE: CVE-2019-5114
Published: 2019-10-25
Description: An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and,in certain configuration, access the underlying operating system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0906; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0906
CVE: CVE-2019-5116
Published: 2019-10-25
Description: An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configuration, access the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0907; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0907
CVE: CVE-2019-5117
Published: 2019-10-25
Description: Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configuration, access the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0908; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0908
CVE: CVE-2019-5119
Published: 2019-10-25
Description: An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configurations, access the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0909; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0909
CVE: CVE-2019-5120
Published: 2019-10-25
Description: An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configurations, access the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0910; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0910
CVE: CVE-2019-5121
Published: 2019-10-25
Description: SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911
CVE: CVE-2019-5122
Published: 2019-10-25
Description: SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911
CVE: CVE-2019-5123
Published: 2019-10-25
Description: Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0911
CVE: CVE-2019-5127
Published: 2019-10-25
Description: A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917
CVE: CVE-2019-5128
Published: 2019-10-25
Description: A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917
CVE: CVE-2019-5129
Published: 2019-10-25
Description: A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getSpiritsFromVideo.php is vulnerable to a command injection attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0917
CVE: CVE-2019-17138
Published: 2019-10-25
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion from JPEG to EPS. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8809.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-908/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17139
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Javascript in the HTML2PDF plugin. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8692.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-909/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17140
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the OnFocus event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9091.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-910/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17141
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Calculate action of a text field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9044.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-911/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17142
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Keystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9081.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-912/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17143
Published: 2019-10-25
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9273.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-19-913/; https://www.zerodayinitiative.com/advisories/ZDI-19-913/
CVE: CVE-2019-17144
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DWG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9274.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-19-914/; https://www.zerodayinitiative.com/advisories/ZDI-19-914/
CVE: CVE-2019-17145
Published: 2019-10-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9276.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-19-915/; https://www.zerodayinitiative.com/advisories/ZDI-19-915/
CVE: CVE-2019-5508
Published: 2019-10-25
Description: Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker to use l2ping to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-14742
Published: 2019-10-25
Description: Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/43236/; https://www.exploit-db.com/exploits/43236/