deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14654
Published: 2019-08-05
Description: In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
CVSS Score: 8.8 (HIGH)
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html
CVE: CVE-2019-14655
Published: 2019-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-18462
Published: 2019-08-05
Description: cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18464
Published: 2019-08-05
Description: cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18465
Published: 2019-08-05
Description: cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18466
Published: 2019-08-05
Description: cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18467
Published: 2019-08-05
Description: cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18468
Published: 2019-08-05
Description: cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2019-14521
Published: 2019-08-05
Description: The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html; https://energylogserver.pl/en/; https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7
CVE: CVE-2019-14525
Published: 2019-08-05
Description: In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call.
CVSS Score: 4.9 (MEDIUM)
References: https://github.com/OctopusDeploy/Issues/issues/5753; https://github.com/OctopusDeploy/Issues/issues/5754; https://octopus.com/downloads/compare?from=2019.6.6&to=2019.7.7
CVE: CVE-2019-14662
Published: 2019-08-05
Description: Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/brandy/bugs/7/; https://sourceforge.net/p/brandy/bugs/7/
CVE: CVE-2019-14663
Published: 2019-08-05
Description: Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/brandy/bugs/6/; https://sourceforge.net/p/brandy/bugs/6/
CVE: CVE-2016-10767
Published: 2019-08-05
Description: cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10768
Published: 2019-08-05
Description: cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10769
Published: 2019-08-05
Description: cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10770
Published: 2019-08-05
Description: cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10771
Published: 2019-08-05
Description: cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10772
Published: 2019-08-05
Description: cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
CVSS Score: 3.3 (LOW)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10773
Published: 2019-08-05
Description: cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10774
Published: 2019-08-05
Description: cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://news.cpanel.com/cpanel-tsr-2016-0006-full-disclosure/; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2016-10775
Published: 2019-08-05
Description: cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/60+Change+Log; https://documentation.cpanel.net/display/CL/60+Change+Log
CVE: CVE-2017-18469
Published: 2019-08-05
Description: cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18470
Published: 2019-08-05
Description: cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
CVSS Score: 8.8 (HIGH)
CWE: CWE-255
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18471
Published: 2019-08-05
Description: cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/tsr-2017-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18472
Published: 2019-08-05
Description: cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/tsr-2017-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18473
Published: 2019-08-05
Description: cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/tsr-2017-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18474
Published: 2019-08-05
Description: cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18475
Published: 2019-08-05
Description: In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18476
Published: 2019-08-05
Description: Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18477
Published: 2019-08-05
Description: In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18478
Published: 2019-08-05
Description: In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18479
Published: 2019-08-05
Description: In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18480
Published: 2019-08-05
Description: cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18481
Published: 2019-08-05
Description: cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://news.cpanel.com/tsr-2017-0001-full-disclosure/; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2017-18482
Published: 2019-08-05
Description: cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/62+Change+Log; https://documentation.cpanel.net/display/CL/62+Change+Log
CVE: CVE-2019-4261
Published: 2019-08-05
Description: IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160013; https://www.ibm.com/support/docview.wss?uid=ibm10886887; https://exchange.xforce.ibmcloud.com/vulnerabilities/160013
CVE: CVE-2019-4284
Published: 2019-08-05
Description: IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160512; https://www.ibm.com/support/docview.wss?uid=ibm10885454; https://exchange.xforce.ibmcloud.com/vulnerabilities/160512
CVE: CVE-2019-4473
Published: 2019-08-05
Description: Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.ibm.com/support/docview.wss?uid=ibm10960422; https://exchange.xforce.ibmcloud.com/vulnerabilities/163984; http://www.ibm.com/support/docview.wss?uid=ibm10960422
CVE: CVE-2019-14348
Published: 2019-08-05
Description: The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/153963/WordPress-JoomSport-3.3-SQL-Injection.html; https://hackpuntes.com/cve-2019-14348-joomsport-for-sports-sql-injection/; https://wpvulndb.com/vulnerabilities/9499
CVE: CVE-2019-11270
Published: 2019-08-05
Description: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-732
References: https://pivotal.io/security/cve-2019-11270; https://www.cloudfoundry.org/blog/cve-2019-11270; https://pivotal.io/security/cve-2019-11270
CVE: CVE-2019-3717
Published: 2019-08-05
Description: Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system during platform boot. Refer to https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en for versions affected by this vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en; https://www.dell.com/support/article/us/en/04/sln317683/dsa-2019-043-dell-client-improper-access-control-vulnerability?lang=en
CVE: CVE-2019-3800
Published: 2019-08-05
Description: CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522, CWE-200
References: https://pivotal.io/security/cve-2019-3800; https://www.cloudfoundry.org/blog/cve-2019-3800; https://pivotal.io/security/cve-2019-3800
CVE: CVE-2019-11198
Published: 2019-08-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes; https://outpost24.com/blog; https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes
CVE: CVE-2019-12264
Published: 2019-08-05
Description: Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-88
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://support.f5.com/csp/article/K41190253; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03960en_us
CVE: CVE-2018-4700
Published: 2019-08-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-4300. Reason: This candidate is a duplicate of CVE-2018-4300. Notes: All CVE users should reference CVE-2018-4300 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-10980
Published: 2019-08-05
Description: A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-06; https://www.us-cert.gov/ics/advisories/icsa-19-213-06
CVE: CVE-2019-10994
Published: 2019-08-05
Description: Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-19-213-06; https://www.us-cert.gov/ics/advisories/icsa-19-213-06
CVE: CVE-2019-14546
Published: 2019-08-05
Description: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, which fires when the victim replies or forwards the mail, thus helping him steal victims' cookies (hence compromising their accounts).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gauravnarwani.com/publications/CVE-2019-14546/; https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5; https://github.com/espocrm/espocrm/issues/1369
CVE: CVE-2019-14547
Published: 2019-08-05
Description: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gauravnarwani.com/publications/cve-2019-14547/; https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5; https://github.com/espocrm/espocrm/issues/1369
CVE: CVE-2019-14548
Published: 2019-08-05
Description: An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gauravnarwani.com/publications/cve-2019-14548/; https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5; https://github.com/espocrm/espocrm/issues/1369
CVE: CVE-2019-14549
Published: 2019-08-05
Description: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gauravnarwani.com/publications/cve-2019-14549/; https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5; https://github.com/espocrm/espocrm/issues/1369
CVE: CVE-2019-14550
Published: 2019-08-05
Description: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gauravnarwani.com/publications/cve-2019-14550/; https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5; https://github.com/espocrm/espocrm/issues/1369
CVE: CVE-2019-14665
Published: 2019-08-05
Description: Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/brandy/bugs/8/; https://sourceforge.net/p/brandy/bugs/8/
CVE: CVE-2019-5502
Published: 2019-08-05
Description: SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or modification of data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-327
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14475
Published: 2019-08-05
Description: eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://psytester.github.io/CVE-2019-14475; https://psytester.github.io/CVE-2019-14475