deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0210
Published: 2019-10-29
Description: In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://mail-archives.apache.org/mod_mbox/thrift-dev/201910.mbox/%3C277A46CA87494176B1BBCF5D72624A2A%40HAGGIS%3E; https://access.redhat.com/errata/RHSA-2020:0804; https://access.redhat.com/errata/RHSA-2020:0805
CVE: CVE-2019-10208
Published: 2019-10-29
Description: A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10208; https://www.postgresql.org/about/news/1960/
CVE: CVE-2019-10209
Published: 2019-10-29
Description: Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.
CVSS Score: 2.2 (LOW)
CWE: CWE-125, CWE-200, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10209; https://www.postgresql.org/about/news/1960/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10209
CVE: CVE-2019-10210
Published: 2019-10-29
Description: Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10210; https://www.postgresql.org/about/news/1960/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10210
CVE: CVE-2019-10211
Published: 2019-10-29
Description: Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211; https://www.postgresql.org/about/news/1960/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10211
CVE: CVE-2019-10743
Published: 2019-10-29
Description: All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, which results in the final path ending up outside of the target folder. For instance, a zip may hold a file with a "../../file.exe" location and thus break out of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/mholt/archiver/pull/169; https://snyk.io/research/zip-slip-vulnerability; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMHOLTARCHIVERCMDARC-174728%2C
CVE: CVE-2019-10748
Published: 2019-10-29
Description: Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sequelize/sequelize/commit/a72a3f5%2C; https://github.com/sequelize/sequelize/pull/11089%2C; https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450221
CVE: CVE-2019-10749
Published: 2019-10-29
Description: sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68; https://snyk.io/vuln/SNYK-JS-SEQUELIZE-450222; https://github.com/sequelize/sequelize/commit/ee4017379db0059566ecb5424274ad4e2d66bc68
CVE: CVE-2019-13066
Published: 2019-10-29
Description: Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/154985/Sahi-Pro-8.x-Cross-Site-Scripting.html; https://sahipro.com/downloads-archive/; https://packetstormsecurity.com/files/154985/Sahi-Pro-8.x-Cross-Site-Scripting.html
CVE: CVE-2019-15678
Published: 2019-10-29
Description: TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf; https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE: CVE-2019-15679
Published: 2019-10-29
Description: TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf; https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE: CVE-2019-15680
Published: 2019-10-29
Description: TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf; https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE: CVE-2019-15681
Published: 2019-10-29
Description: LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html; https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
CVE: CVE-2019-15683
Published: 2019-10-29
Description: TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea[PII_REDACTED]1e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea[PII_REDACTED]1e614e0d36776bf9435a536136e.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://github.com/TurboVNC/turbovnc/commit/cea[PII_REDACTED]1e614e0d36776bf9435a536136e; https://github.com/TurboVNC/turbovnc/commit/cea[PII_REDACTED]1e614e0d36776bf9435a536136e
CVE: CVE-2019-16647
Published: 2019-10-29
Description: Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
CVSS Score: 7.2 (HIGH)
CWE: CWE-428
References: http://forum.maxthon.com/index.php?/topic/24472-unquoted-search-path-and-potential-abuses/; https://safebreach.com/Post/Maxthon-Browser-for-Windows-Unquoted-Search-Path-and-Potential-Abuses-CVE-2019-16647; http://forum.maxthon.com/index.php?/topic/24472-unquoted-search-path-and-potential-abuses/
CVE: CVE-2019-18601
Published: 2019-10-29
Description: OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTE_Debug RPC calls to crash a database server within the SVOTE_Debug RPC handler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html; https://openafs.org/pages/security/OPENAFS-SA-2019-003.txt; https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html
CVE: CVE-2019-18602
Published: 2019-10-29
Description: OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over the network to a peer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html; https://openafs.org/pages/security/OPENAFS-SA-2019-002.txt; https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html
CVE: CVE-2019-18603
Published: 2019-10-29
Description: OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to a peer.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-908
References: https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html; https://openafs.org/pages/security/OPENAFS-SA-2019-001.txt; https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html
CVE: CVE-2019-18604
Published: 2019-10-29
Description: In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a; https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html; https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a
CVE: CVE-2019-18608
Published: 2019-10-29
Description: Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT /ajax/cart operation for a checkout, because of getValidDocumentForUpdate in api/server/services/orders/orders.js.
CVSS Score: 7.5 (HIGH)
References: https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md; https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md
CVE: CVE-2019-18611
Published: 2019-10-29
Description: An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially visible to users with various levels of access to this extension. Said users should not have been able to view these oversighted edit summaries via the MediaWiki API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765; https://phabricator.wikimedia.org/T234862; https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765
CVE: CVE-2019-18612
Published: 2019-10-29
Description: An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were viewable (or their differences were viewable) to unprivileged users, thus disclosing potentially sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a; https://phabricator.wikimedia.org/T104807; https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a
CVE: CVE-2019-18624
Published: 2019-10-29
Description: Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Override) approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and 44.1.2254.143214.
CVSS Score: 9.8 (CRITICAL)
References: http://firstsight.me/2019/10/illegal-rendered-at-download-feature-in-several-apps-including-opera-mini-that-lead-to-extension-manipulation-with-rtlo/; https://medium.com/%40YoKoKho/illegal-rendered-at-download-feature-in-opera-mini-that-lead-to-extension-manipulation-with-rtlo-685bf2d77d51; http://firstsight.me/2019/10/illegal-rendered-at-download-feature-in-several-apps-including-opera-mini-that-lead-to-extension-manipulation-with-rtlo/
CVE: CVE-2019-3976
Published: 2019-10-29
Description: RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.tenable.com/security/research/tra-2019-46; https://www.tenable.com/security/research/tra-2019-46
CVE: CVE-2019-3977
Published: 2019-10-29
Description: RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494, CWE-494
References: https://www.tenable.com/security/research/tra-2019-46; https://www.tenable.com/security/research/tra-2019-46
CVE: CVE-2019-3978
Published: 2019-10-29
Description: RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/155036/MikroTik-RouterOS-6.45.6-DNS-Cache-Poisoning.html; https://www.tenable.com/security/research/tra-2019-46; http://packetstormsecurity.com/files/155036/MikroTik-RouterOS-6.45.6-DNS-Cache-Poisoning.html
CVE: CVE-2019-3979
Published: 2019-10-29
Description: RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's DNS cache via malicious responses with additional and untrue records.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://www.tenable.com/security/research/tra-2019-46; https://www.tenable.com/security/research/tra-2019-46
CVE: CVE-2019-5533
Published: 2019-10-29
Description: In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.vmware.com/security/advisories/VMSA-2019-0017.html; https://www.vmware.com/security/advisories/VMSA-2019-0017.html
CVE: CVE-2019-6841
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with no firmware image inside the package using FTP protocol.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6842
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with a missing web server image inside the package using FTP protocol.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6843
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6844
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service atack on the PLC when upgrading the controller with a firmware package containing an invalid web server image using FTP protocol.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6845
Published: 2019-10-29
Description: A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information when transferring applications to the controller using Modbus TCP protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-03; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-03
CVE: CVE-2019-6846
Published: 2019-10-29
Description: A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02
CVE: CVE-2019-6847
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the application in the controller using FTP protocol.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6848
Published: 2019-10-29
Description: A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info), which could cause a Denial of Service attack on the PLC when sending specific data on the REST API of the controller/communication module.
CVSS Score: 8.6 (HIGH)
CWE: CWE-755, CWE-755
References: https://www.se.com/ww/en/download/document/SEVD-2019-281-04/; https://www.se.com/ww/en/download/document/SEVD-2019-281-04/
CVE: CVE-2019-6849
Published: 2019-10-29
Description: A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
CVE: CVE-2019-6850
Published: 2019-10-29
Description: A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
CVE: CVE-2019-6851
Published: 2019-10-29
Description: A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information from the controller when using TFTP protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-538, CWE-200
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-01; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-01
CVE: CVE-2019-8287
Published: 2019-10-29
Description: TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf; https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE: CVE-2019-9757
Published: 2019-10-29
Description: An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9757; https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9757
CVE: CVE-2019-9758
Published: 2019-10-29
Description: An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9758; https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9758
CVE: CVE-2019-9926
Published: 2019-10-29
Description: An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code through a /reports-viewScriptReport.view CSRF vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9926; https://rhinosecuritylabs.com/application-security/labkey-server-vulnerabilities-to-rce/; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2019-9926