deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16570
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1604; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16571
Published: 2019-12-17
Description: A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1604; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16572
Published: 2019-12-17
Description: Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-1024
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1597; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16573
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1600; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16574
Published: 2019-12-17
Description: A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1600; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16575
Published: 2019-12-17
Description: A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-16576
Published: 2019-12-17
Description: A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/12/17/1; https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602; http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE: CVE-2019-19315
Published: 2019-12-17
Description: NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailslot mailslot.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://github.com/monoxgas/mailorder; https://github.com/monoxgas/mailorder
CVE: CVE-2019-19675
Published: 2019-12-17
Description: In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://forums.ivanti.com/s/article/Locally-authenticated-user-can-bypass-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector; https://forums.ivanti.com/s/article/Locally-authenticated-user-can-bypass-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector
CVE: CVE-2019-19714
Published: 2019-12-17
Description: Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://contao.org/en/news.html; https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html; https://contao.org/en/news.html
CVE: CVE-2019-19745
Published: 2019-12-17
Description: Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://contao.org/en/news.html; https://contao.org/en/security-advisories/unrestricted-file-uploads.html; https://contao.org/en/news.html
CVE: CVE-2019-14782
Published: 2019-12-17
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://centos-webpanel.com/changelog-cwp7; https://packetstormsecurity.com/files/155676/Control-Web-Panel-0.9.8.864-phpMyAdmin-Password-Disclosure.html; https://centos-webpanel.com/changelog-cwp7
CVE: CVE-2019-15235
Published: 2019-12-17
Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://centos-webpanel.com/changelog-cwp7; https://packetstormsecurity.com/files/155676/Control-Web-Panel-0.9.8.864-phpMyAdmin-Password-Disclosure.html; https://centos-webpanel.com/changelog-cwp7
CVE: CVE-2019-18670
Published: 2019-12-17
Description: In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM. This is a DLL Hijacking vulnerability (including search order hijacking, which searches for the missing DLL in the PATH environment variable), which is caused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://drive.google.com/open?id=1r0cr-H_FMc8V4hwlqF1MAEhSSnztm5sp; https://us.answers.acer.com/app/answers/detail/a_id/64586; https://drive.google.com/open?id=1r0cr-H_FMc8V4hwlqF1MAEhSSnztm5sp
CVE: CVE-2019-18956
Published: 2019-12-17
Description: Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956; https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956
CVE: CVE-2019-19847
Published: 2019-12-17
Description: Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://github.com/fontforge/libspiro/issues/21; https://github.com/fontforge/libspiro/issues/21
CVE: CVE-2019-19848
Published: 2019-12-17
Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security; https://typo3.org/security/advisory/typo3-core-sa-2019-024/; https://review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security
CVE: CVE-2019-19849
Published: 2019-12-17
Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security; https://typo3.org/security/advisory/typo3-core-sa-2019-026/; https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security
CVE: CVE-2019-19850
Published: 2019-12-17
Description: An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://review.typo3.org/q/%2522Resolves:+%252389452%2522+topic:security; https://typo3.org/security/advisory/typo3-core-sa-2019-025/; https://review.typo3.org/q/%2522Resolves:+%252389452%2522+topic:security
CVE: CVE-2012-2237
Published: 2019-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2012/dsa-2540; https://bugs.launchpad.net/mahara/+bug/1009774; https://bugs.launchpad.net/mahara/+bug/1009777
CVE: CVE-2013-0202
Published: 2019-12-17
Description: Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/81476; https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3/; https://exchange.xforce.ibmcloud.com/vulnerabilities/81476
CVE: CVE-2014-8179
Published: 2019-12-17
Description: Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00014.html; http://lists.opensuse.org/opensuse-updates/2015-10/msg00036.html; https://blog.docker.com/2015/10/security-release-docker-1-8-3-1-6-2-cs7/
CVE: CVE-2019-19634
Published: 2019-12-17
Description: class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/jra89/CVE-2019-19634; https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068; https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
CVE: CVE-2019-19497
Published: 2019-12-17
Description: MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Dmitriy-area51/Exploit/blob/master/CVE-2019-19497/README.md; https://twitter.com/Dmitriy_Area51; https://github.com/Dmitriy-area51/Exploit/blob/master/CVE-2019-19497/README.md
CVE: CVE-2019-0383
Published: 2019-12-17
Description: Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/2819170; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390; https://launchpad.support.sap.com/#/notes/2819170
CVE: CVE-2019-0384
Published: 2019-12-17
Description: Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/2828981; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390; https://launchpad.support.sap.com/#/notes/2828981
CVE: CVE-2019-19241
Published: 2019-12-17
Description: In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.
CVSS Score: 7.8 (HIGH)
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1975; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7
CVE: CVE-2019-17334
Published: 2019-12-17
Description: The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system. This attack is a risk only when the attacker has write access to a network file system shared with the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0, TIBCO Spotfire Deployment Kit: versions 7.11.1 and below, TIBCO Spotfire Desktop: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, and TIBCO Spotfire Desktop Language Packs: versions 7.11.1 and below.
CVSS Score: 8.0 (HIGH)
CWE: CWE-276
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17334; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-17335
Published: 2019-12-17
Description: The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
CVSS Score: 6.5 (MEDIUM)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17335; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-17336
Published: 2019-12-17
Description: The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to information that can lead to obtaining credentials used to access Spotfire data sources. The attacker would need privileges to save a Spotfire file to the library, and only applies in a situation where NTLM credentials, or a credentials profile is in use. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
CVSS Score: 6.5 (MEDIUM)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17336; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-17337
Published: 2019-12-17
Description: The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17337; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-3992
Published: 2019-12-17
Description: ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames and, in older versions of ELOG, passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-319
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/; https://www.tenable.com/security/research/tra-2019-53
CVE: CVE-2019-3993
Published: 2019-12-17
Description: ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by sending a crafted HTTP POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-319
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/; https://www.tenable.com/security/research/tra-2019-53
CVE: CVE-2019-3994
Published: 2019-12-17
Description: ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieve_url() to use a freed variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/; https://www.tenable.com/security/research/tra-2019-53
CVE: CVE-2019-3995
Published: 2019-12-17
Description: ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash the ELOG server by sending a crafted HTTP GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/; https://www.tenable.com/security/research/tra-2019-53
CVE: CVE-2019-3996
Published: 2019-12-17
Description: ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-441, CWE-610
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IN3FP6VXYSD4OMUCFZNOL7MKPWRQFAL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4IAS4HI24H2ERKBZTDEVJ3LEQEFWYSCT/; https://www.tenable.com/security/research/tra-2019-53
CVE: CVE-2019-11657
Published: 2019-12-17
Description: Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-0/ta-p/2750305?attachment-id=76910; https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-0/ta-p/2750305?attachment-id=76910