deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-21013
Published: 2019-09-09
Description: The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://wpvulndb.com/vulnerabilities/9024; https://wpvulndb.com/vulnerabilities/9024
CVE: CVE-2018-21014
Published: 2019-09-09
Description: The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9007; https://wpvulndb.com/vulnerabilities/9007
CVE: CVE-2019-10665
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/; https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-023/
CVE: CVE-2019-10666
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829
References: https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-020/; https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-020/
CVE: CVE-2019-10667
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.darkmatter.ae/xen1thlabs/librenms-information-disclosure-vulnerability-xl-19-018/; https://www.darkmatter.ae/xen1thlabs/librenms-information-disclosure-vulnerability-xl-19-018/
CVE: CVE-2019-10668
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.darkmatter.ae/xen1thlabs/librenms-authentication-bypass-vulnerability-xl-19-016/; https://www.darkmatter.ae/xen1thlabs/librenms-authentication-bypass-vulnerability-xl-19-016/
CVE: CVE-2019-10669
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. This function is not the appropriate function to sanitize command arguments as it does not escape a number of command line syntax characters such as ` (backtick), allowing an attacker to inject commands into the variable $rrd_cmd, which gets executed via passthru().
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/154391/LibreNMS-Collectd-Command-Injection.html; https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xl-19-017/; http://packetstormsecurity.com/files/154391/LibreNMS-Collectd-Command-Injection.html
CVE: CVE-2019-15639
Published: 2019-09-09
Description: main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://downloads.asterisk.org/pub/security/AST-2019-005.html; http://packetstormsecurity.com/files/154372/Asterisk-Project-Security-Advisory-AST-2019-005.html; http://downloads.asterisk.org/pub/security/AST-2019-005.html
CVE: CVE-2019-15895
Published: 2019-09-09
Description: search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://blog.nintechnet.com/settings-change-vulnerability-in-wordpress-search-exclude-plugin/; https://wordpress.org/plugins/search-exclude/#developers; https://wpvulndb.com/vulnerabilities/9870
CVE: CVE-2019-16114
Published: 2019-09-09
Description: In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2019-16114/README.md; https://github.com/atutor/ATutor/commits/master; https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2019-16114/README.md
CVE: CVE-2019-16146
Published: 2019-09-09
Description: Gophish through 0.8.0 allows XSS via a username.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/gophish/gophish/pull/1547; https://github.com/gophish/gophish/pull/1547
CVE: CVE-2019-16148
Published: 2019-09-09
Description: Sakai through 12.6 allows XSS via a chat user name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sakaiproject/sakai/pull/6971; https://github.com/sakaiproject/sakai/pull/6971
CVE: CVE-2019-10670
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these contexts, leading to attacker controlled JavaScript executing in the browser. One example of this is the string parameter in html/pages/inventory.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.darkmatter.ae/xen1thlabs/librenms-multiple-reflected-cross-site-scripting-vulnerability-xl-19-021/; https://www.darkmatter.ae/xen1thlabs/librenms-multiple-reflected-cross-site-scripting-vulnerability-xl-19-021/
CVE: CVE-2019-10671
Published: 2019-09-09
Description: An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.darkmatter.ae/xen1thlabs/librenms-multiple-sql-injection-vulnerability-xl-19-025/; https://www.darkmatter.ae/xen1thlabs/librenms-multiple-sql-injection-vulnerability-xl-19-025/
CVE: CVE-2019-12463
Published: 2019-09-09
Description: An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE: relative to CVE-2019-10665, this requires authentication and the pathnames differ.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-116
References: https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-022/; https://www.darkmatter.ae/xen1thlabs/librenms-rrdtool-injection-vulnerability-xl-19-022/
CVE: CVE-2019-12464
Published: 2019-09-09
Description: An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-019/; https://www.darkmatter.ae/xen1thlabs/librenms-limited-local-file-inclusion-via-directory-traversal-vulnerability-xl-19-019/
CVE: CVE-2019-12465
Published: 2019-09-09
Description: An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.darkmatter.ae/xen1thlabs/librenms-sql-injection-vulnerability-xl-19-024/; https://www.darkmatter.ae/xen1thlabs/librenms-sql-injection-vulnerability-xl-19-024/
CVE: CVE-2019-16159
Published: 2019-09-09
Description: BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://bird.network.cz; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00065.html
CVE: CVE-2019-12405
Published: 2019-09-09
Description: Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://lists.apache.org/thread.html/e128e9d382f3b0d074e2b597ac58e1d[PII_REDACTED]9d81ddbc9e3700e%40%3Cusers.trafficcontrol.apache.org%3E; https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c[PII_REDACTED]dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E; https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf%40%3Ccommits.trafficcontrol.apache.org%3E
CVE: CVE-2019-16161
Published: 2019-09-09
Description: Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/k-takata/Onigmo/commit/9827d5a0298ee766f6041db9c0080166ff6cdce8; https://github.com/k-takata/Onigmo/issues/132; https://github.com/k-takata/Onigmo/commit/9827d5a0298ee766f6041db9c0080166ff6cdce8
CVE: CVE-2019-16162
Published: 2019-09-09
Description: Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/k-takata/Onigmo/issues/139; https://github.com/k-takata/Onigmo/issues/139
CVE: CVE-2019-16163
Published: 2019-09-09
Description: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/kkos/oniguruma/commit/4097828d7cc87589864fecf452f2cd46c5f37180; https://github.com/kkos/oniguruma/compare/v6.9.2...v6.9.3; https://github.com/kkos/oniguruma/issues/147
CVE: CVE-2019-16164
Published: 2019-09-09
Description: MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/lexborisov/myhtml/issues/175; https://github.com/lexborisov/myhtml/issues/175
CVE: CVE-2019-16165
Published: 2019-09-09
Description: GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00001.html; https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00001.html
CVE: CVE-2019-16166
Published: 2019-09-09
Description: GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00000.html; https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00000.html
CVE: CVE-2019-16167
Published: 2019-09-09
Description: sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00068.html; https://github.com/sysstat/sysstat/compare/v12.1.5...v12.1.6
CVE: CVE-2019-16168
Published: 2019-09-09
Description: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html; https://kc.mcafee.com/corporate/index?page=content&id=SB10365
CVE: CVE-2019-5461
Published: 2019-09-09
Description: An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a GitLab instance's internal network. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-20
References: https://gitlab.com//gitlab-org/gitlab-ce/issues/54649; https://hackerone.com/reports/446593; https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
CVE: CVE-2019-5483
Published: 2019-09-09
Description: Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://hackerone.com/reports/526258; https://hackerone.com/reports/526258
CVE: CVE-2019-5463
Published: 2019-09-09
Description: An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200, CWE-862
References: https://gitlab.com/gitlab-org/gitlab-ce/issues/56407; https://hackerone.com/reports/477222; https://gitlab.com/gitlab-org/gitlab-ce/issues/56407
CVE: CVE-2019-5467
Published: 2019-09-09
Description: An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab-ce/issues/60143; https://hackerone.com/reports/526325; https://gitlab.com/gitlab-org/gitlab-ce/issues/60143
CVE: CVE-2019-5471
Published: 2019-09-09
Description: An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab-ee/issues/11515; https://hackerone.com/reports/496973; https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
CVE: CVE-2019-5473
Published: 2019-09-09
Description: An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-288, CWE-287
References: https://gitlab.com/gitlab-org/gitlab-ee/issues/11643; https://hackerone.com/reports/565883; https://gitlab.com/gitlab-org/gitlab-ee/issues/11643
CVE: CVE-2019-11544
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/58372; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11545
Published: 2019-09-09
Description: An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/58939; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11546
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/10357; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11547
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-116
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/11515; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11548
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/58505; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11549
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/57779; https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/
CVE: CVE-2019-11605
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/; https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/
CVE: CVE-2019-16172
Published: 2019-09-09
Description: LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Sep/22; https://github.com/LimeSurvey/LimeSurvey/commit/32d6a5224327b246ee3a2a08500544e4f80f9a9a
CVE: CVE-2019-16173
Published: 2019-09-09
Description: LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Sep/22; https://github.com/LimeSurvey/LimeSurvey/commit/f1c1ad2d24eb262363511fcca2e96ce737064006
CVE: CVE-2019-16190
Published: 2019-09-09
Description: SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as demonstrated by a direct request to folder_view.php or category_view.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cyberloginit.com/2019/09/10/dlink-shareport-web-access-authentication-bypass.html; https://cyberloginit.com/2019/09/10/dlink-shareport-web-access-authentication-bypass.html
CVE: CVE-2019-6782
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 1 of 6). An authorization issue allows the contributed project information of a private profile to be viewed.
CVSS Score: 7.5 (HIGH)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/52677; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/