deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10340
Published: 2019-07-11
Description: A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010
CVE: CVE-2019-10341
Published: 2019-07-11
Description: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010
CVE: CVE-2019-10342
Published: 2019-07-11
Description: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1400
CVE: CVE-2019-10346
Published: 2019-07-11
Description: A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419
CVE: CVE-2019-10347
Published: 2019-07-11
Description: Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775
CVE: CVE-2019-10348
Published: 2019-07-11
Description: Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438
CVE: CVE-2019-10349
Published: 2019-07-11
Description: A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html; http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156
CVE: CVE-2019-10350
Published: 2019-07-11
Description: Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1441
CVE: CVE-2019-10351
Published: 2019-07-11
Description: Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/07/11/4; http://www.securityfocus.com/bid/109156; https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437
CVE: CVE-2019-12363
Published: 2019-07-11
Description: An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate operation lowers the security of the targeted account by disabling two factor authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://community.mybb.com/thread-162369.html; https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities/; https://community.mybb.com/thread-162369.html
CVE: CVE-2019-12537
Published: 2019-07-11
Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109364; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/asset-explorer/readme.html
CVE: CVE-2019-12539
Published: 2019-07-11
Description: An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/service-desk/readme.html; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine
CVE: CVE-2019-12540
Published: 2019-07-11
Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/service-desk/readme.html; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine
CVE: CVE-2019-12595
Published: 2019-07-11
Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109364; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/asset-explorer/sp-readme.html
CVE: CVE-2019-12596
Published: 2019-07-11
Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109364; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/asset-explorer/sp-readme.html
CVE: CVE-2019-12597
Published: 2019-07-11
Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109364; https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine; https://www.manageengine.com/products/asset-explorer/sp-readme.html
CVE: CVE-2019-13506
Published: 2019-07-11
Description: @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nuxt/devalue/pull/8; https://github.com/nuxt/devalue/releases/tag/v1.2.3; https://github.com/nuxt/nuxt.js/commit/0d5dfe71917191c5b07f373896311f2d8f6b75be
CVE: CVE-2019-13507
Published: 2019-07-11
Description: hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/47034; https://www.exploit-db.com/exploits/47034
CVE: CVE-2019-13560
Published: 2019-07-11
Description: D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf; https://www.nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/setupwizard.txt; https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce/
CVE: CVE-2019-13561
Published: 2019-07-11
Description: D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf; https://www.nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/commandinjection.txt; https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce/
CVE: CVE-2019-13562
Published: 2019-07-11
Description: D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the /www/apply_sec.cgi html_response_return_page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf; https://www.nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/crosssitescripting.txt; https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce/
CVE: CVE-2019-13563
Published: 2019-07-11
Description: D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-655/REVC/DIR-655_REVC_RELEASE_NOTES_v3.02B05_BETA03.pdf; https://www.nccgroup.trust/contentassets/7188fe7f130846ffa31827fc1661d120/csrf.txt; https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/july/the-d-link-dir-655c-from-nothing-to-rce/
CVE: CVE-2019-10651
Published: 2019-07-11
Description: An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In other words, the issue affects 2017.3, 2018.1, and 2018.3 installations that lack the April 2019 update.
CVSS Score: 9.8 (CRITICAL)
References: https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Endpoint-Manager-April-2019; https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Endpoint-Manager-April-2019
CVE: CVE-2019-11268
Published: 2019-07-11
Description: Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-116
References: https://www.cloudfoundry.org/blog/cve-2019-11268; https://www.cloudfoundry.org/blog/cve-2019-11268
CVE: CVE-2019-13564
Published: 2019-07-11
Description: XSS exists in Ping Identity Agentless Integration Kit before 1.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154274/Ping-Identity-Agentless-Integration-Kit-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Aug/33; https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190305-01_Ping_Identity_Agentless_Integration_Kit_Reflected_XSS
CVE: CVE-2018-17150
Published: 2019-07-11
Description: Intersystems Cache 2017.2.2.865.0 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities; https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE: CVE-2018-17151
Published: 2019-07-11
Description: Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities; https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE: CVE-2018-17152
Published: 2019-07-11
Description: Intersystems Cache 2017.2.2.865.0 allows XXE.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-611
References: https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities; https://know.bishopfox.com/advisories/intersystems-cache-2017-2-2-865-0-vulnerabilities
CVE: CVE-2018-19588
Published: 2019-07-11
Description: Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://www.vfxcomputing.com/?CVE-2018-19588; https://www.vfxcomputing.com/?CVE-2018-19588
CVE: CVE-2019-10135
Published: 2019-07-11
Description: A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10135; https://github.com/containerbuildsystem/osbs-client/pull/865; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10135
CVE: CVE-2019-10192
Published: 2019-07-11
Description: A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/109290; https://access.redhat.com/errata/RHSA-2019:1819; https://access.redhat.com/errata/RHSA-2019:1860
CVE: CVE-2019-10193
Published: 2019-07-11
Description: A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/109290; https://access.redhat.com/errata/RHSA-2019:1819; https://access.redhat.com/errata/RHSA-2019:2002
CVE: CVE-2019-10194
Published: 2019-07-11
Description: Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://www.securityfocus.com/bid/109140; https://access.redhat.com/errata/RHSA-2019:2499; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194
CVE: CVE-2019-11062
Published: 2019-07-11
Description: The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://surl.twcert.org.tw/hLFFM; https://gist.github.com/tonykuo76/476164af9bc672281b9a3394f01c17f0; https://tvn.twcert.org.tw/taiwanvn/TVN-201906001
CVE: CVE-2019-12525
Published: 2019-07-11
Description: An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html; http://www.squid-cache.org/Versions/v4/changesets/
CVE: CVE-2019-12527
Published: 2019-07-11
Description: An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html; http://www.securityfocus.com/bid/109143
CVE: CVE-2019-12529
Published: 2019-07-11
Description: An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html; http://www.squid-cache.org/Versions/v4/changesets/
CVE: CVE-2019-13029
Published: 2019-07-11
Description: Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153691/REDCap-Cross-Site-Scripting.html; https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2019-13029/REDCap%20Cross%20Site%20Scripting.txt; https://gitlab.com/snippets/1874216
CVE: CVE-2019-3854
Published: 2019-07-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-3889
Published: 2019-07-11
Description: A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2019:3722; https://access.redhat.com/errata/RHSA-2019:3770; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3889
CVE: CVE-2019-7003
Published: 2019-07-11
Description: A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/109134; https://downloads.avaya.com/css/P8/documents/101059368; https://support.avaya.com/documents/documents-by-contenttype.action?product_id=P0941&product_name=Control+Manager&release_number=releaseId&contentType=ReleaseNotes
CVE: CVE-2019-9657
Published: 2019-07-11
Description: Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates (used for initiating a VPN session to the Alarm.com infrastructure) on the local camera device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://www.vfxcomputing.com/?CVE-2019-9657; https://www.vfxcomputing.com/?CVE-2019-9657
CVE: CVE-2019-9886
Published: 2019-07-11
Description: Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-284, CWE-22
References: http://surl.twcert.org.tw/aTxze; https://tvn.twcert.org.tw/taiwanvn/TVN-201906004; https://zeroday.hitcon.org/vulnerability/ZD-2019-00423
CVE: CVE-2014-3798
Published: 2019-07-11
Description: The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (guest OS crash) via a crafted Ethernet frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/58455; http://support.citrix.com/article/CTX140814; http://www.securityfocus.com/bid/67693
CVE: CVE-2018-1968
Published: 2019-07-11
Description: IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10958077; https://exchange.xforce.ibmcloud.com/vulnerabilities/153749; http://www.ibm.com/support/docview.wss?uid=ibm10958077
CVE: CVE-2019-0046
Published: 2019-07-11
Description: A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A reboot of the device is required to restore service. Continued receipt of these valid broadcast packets will create a sustained Denial of Service (DoS) against the device. Affected releases are Juniper Networks Junos OS: 16.1 versions above and including 16.1R1 prior to 16.1R7-S5; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/109272; https://kb.juniper.net/JSA10938; http://www.securityfocus.com/bid/109272