deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10581
Published: 2020-01-21
Description: NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, MDM9206, MDM9207C, MDM9607, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8998, Nicobar, QCS605, Rennell, SA6155P, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10582
Published: 2020-01-21
Description: Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8096AU, MSM8909W, Nicobar, QCS605, SA6155P, SDA845, SDM429W, SDM670, SDM710, SDM845, SM6150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10583
Published: 2020-01-21
Description: Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8096AU, MDM9607, MSM8909W, Nicobar, QCS605, SA6155P, SDA845, SDM429W, SDM670, SDM710, SDM845, SM6150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10585
Published: 2020-01-21
Description: Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MDM9607, MDM9640, MSM8909W, MSM8917, MSM8953, Nicobar, QCS605, QM215, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX24, SDX55, SM6150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10602
Published: 2020-01-21
Description: Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, QCS605, SDA660, SDM845, SDX20, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10606
Published: 2020-01-21
Description: Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, QCS605, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-10611
Published: 2020-01-21
Description: Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, Nicobar, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14003
Published: 2020-01-21
Description: Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14004
Published: 2020-01-21
Description: Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14005
Published: 2020-01-21
Description: Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14006
Published: 2020-01-21
Description: Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14008
Published: 2020-01-21
Description: Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9607, MDM9650, SDM660, SDM845, SM8150, SM8250, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14010
Published: 2020-01-21
Description: The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14013
Published: 2020-01-21
Description: While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the table in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14014
Published: 2020-01-21
Description: Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in Nicobar, SDM670, SDM710, SDM845, SM6150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14016
Published: 2020-01-21
Description: Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, Nicobar, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14017
Published: 2020-01-21
Description: Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14023
Published: 2020-01-21
Description: String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminated before string copy in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14024
Published: 2020-01-21
Description: Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14034
Published: 2020-01-21
Description: Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, Nicobar, QCS605, QM215, Rennell, SA6155P, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-14036
Published: 2020-01-21
Description: Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MDM9615, MDM9640, MSM8996AU, QCN7605
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2019-2267
Published: 2020-01-21
Description: Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin
CVE: CVE-2020-7246
Published: 2020-01-21
Description: A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: http://packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.html; http://packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.html
CVE: CVE-2011-2668
Published: 2020-01-21
Description: Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
CVSS Score: 8.8 (HIGH)
References: http://jvn.jp/en/jp/JVN36721438/index.html; http://jvn.jp/en/jp/JVN36721438/index.html
CVE: CVE-2011-2669
Published: 2020-01-21
Description: Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN70984231/index.html; http://jvn.jp/en/jp/JVN70984231/index.html
CVE: CVE-2011-4094
Published: 2020-01-21
Description: Jara 1.6 has a SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://seclists.org/fulldisclosure/2011/Oct/767; https://www.exploit-db.com/exploits/18020; https://www.openwall.com/lists/oss-security/2011/10/31/4
CVE: CVE-2011-4095
Published: 2020-01-21
Description: Jara 1.6 has an XSS vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/oss-sec/2011/q4/193; https://www.openwall.com/lists/oss-security/2011/10/31/4; https://seclists.org/oss-sec/2011/q4/193
CVE: CVE-2011-4322
Published: 2020-01-21
Description: websitebaker prior to and including 2.8.1 has an authentication error in backup module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.openwall.com/lists/oss-security/2011/11/21/2; https://www.openwall.com/lists/oss-security/2011/11/21/2
CVE: CVE-2015-6907
Published: 2020-01-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-7470
Published: 2020-01-21
Description: Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sku11army.blogspot.com/2020/01/sonoff-sonoff-th-module-vuln-xss.html; https://sku11army.blogspot.com/2020/01/sonoff-sonoff-th-module-vuln-xss.html
CVE: CVE-2011-5282
Published: 2020-01-21
Description: mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.mirc.com/news.html; http://www.mirc.com/news.html
CVE: CVE-2012-5190
Published: 2020-01-21
Description: Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/57242; https://exchange.xforce.ibmcloud.com/vulnerabilities/81163; http://www.securityfocus.com/bid/57242
CVE: CVE-2019-14765
Published: 2020-01-21
Description: Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.
CVSS Score: 8.8 (HIGH)
References: https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305; https://www.dimo-crm.fr/blog-crm/; https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305
CVE: CVE-2019-14766
Published: 2020-01-21
Description: Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305; https://www.dimo-crm.fr/blog-crm/; https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305
CVE: CVE-2019-14767
Published: 2020-01-21
Description: In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305; https://www.dimo-crm.fr/blog-crm/; https://www.elysium-security.com/sitemap.php
CVE: CVE-2019-14768
Published: 2020-01-21
Description: An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat server via Path Traversal, allowing remote code execution with SYSTEM privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305; https://www.dimo-crm.fr/blog-crm/; https://gist.github.com/sm0k/5de[PII_REDACTED]9b0bcfa719b87c17305
CVE: CVE-2019-3864
Published: 2020-01-21
Description: A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3864; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3864
CVE: CVE-2019-19392
Published: 2020-01-21
Description: The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://blog.joaoorvalho.com/description-cve-2019-19392/; https://github.com/fordnn/usersexportimport/commits/master; https://blog.joaoorvalho.com/description-cve-2019-19392/
CVE: CVE-2020-6857
Published: 2020-01-21
Description: CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327, CWE-798
References: http://hyp3rlinx.altervista.org; http://packetstormsecurity.com/files/156015/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html; http://packetstormsecurity.com/files/157321/Neowise-CarbonFTP-1.4-Insecure-Proprietary-Password-Encryption.html
CVE: CVE-2020-7211
Published: 2020-01-21
Description: tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2020/01/17/2; https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4; https://security-tracker.debian.org/tracker/CVE-2020-7211
CVE: CVE-2020-7213
Published: 2020-01-21
Description: Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a parallels_updates.xml file on the http://update.parallels.com web site.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://almorabea.net/cves/cve-2020-7213.txt; http://almorabea.net/en/2020/01/19/write-up-for-the-parallel-vulnerability-cve-2020-7213/; https://parallels.com