deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20500
Published: 2019-05-17
Description: An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/
CVE: CVE-2018-3701
Published: 2019-05-17
Description: Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/108387; https://support.f5.com/csp/article/K00245734; https://support.lenovo.com/us/en/product_security/LEN-27701
CVE: CVE-2019-0086
Published: 2019-05-17
Description: Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-732
References: https://danishcyberdefence.dk/blog/dal; https://support.f5.com/csp/article/K35815741; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html
CVE: CVE-2019-0089
Published: 2019-05-17
Description: Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-19
References: https://support.f5.com/csp/article/K47234311; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K47234311
CVE: CVE-2019-0090
Published: 2019-05-17
Description: Insufficient access control vulnerability in subsystem for Intel(R) CSME before versions 11.x, 12.0.35 Intel(R) TXE 3.x, 4.x, Intel(R) Server Platform Services 3.x, 4.x, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 7.1 (HIGH)
References: https://support.f5.com/csp/article/K59145983; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K59145983
CVE: CVE-2019-0091
Published: 2019-05-17
Description: Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://support.f5.com/csp/article/K21423526; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K21423526
CVE: CVE-2019-0092
Published: 2019-05-17
Description: Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K84591451; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K84591451
CVE: CVE-2019-0093
Published: 2019-05-17
Description: Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
References: https://support.f5.com/csp/article/K13710800; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K13710800
CVE: CVE-2019-0094
Published: 2019-05-17
Description: Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable denial of service via adjacent network access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K84591451; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K84591451
CVE: CVE-2019-0096
Published: 2019-05-17
Description: Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://support.f5.com/csp/article/K84591451; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K84591451
CVE: CVE-2019-0097
Published: 2019-05-17
Description: Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network access.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://support.f5.com/csp/article/K84591451; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K84591451
CVE: CVE-2019-0098
Published: 2019-05-17
Description: Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://support.f5.com/csp/article/K10522033; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K10522033
CVE: CVE-2019-0099
Published: 2019-05-17
Description: Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.8 (MEDIUM)
References: https://support.f5.com/csp/article/K30105730; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K30105730
CVE: CVE-2019-0113
Published: 2019-05-17
Description: Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/108385; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html; http://www.securityfocus.com/bid/108385
CVE: CVE-2019-0114
Published: 2019-05-17
Description: A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.securityfocus.com/bid/108385; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html; http://www.securityfocus.com/bid/108385
CVE: CVE-2019-0115
Published: 2019-05-17
Description: Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108385; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html; http://www.securityfocus.com/bid/108385
CVE: CVE-2019-0116
Published: 2019-05-17
Description: An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108385; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html; http://www.securityfocus.com/bid/108385
CVE: CVE-2019-0119
Published: 2019-05-17
Description: Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/108485; https://support.f5.com/csp/article/K85585101; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html
CVE: CVE-2019-0120
Published: 2019-05-17
Description: Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: http://www.securityfocus.com/bid/108485; https://support.f5.com/csp/article/K29002929; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html
CVE: CVE-2019-0126
Published: 2019-05-17
Description: Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
CVSS Score: 6.7 (MEDIUM)
References: http://www.securityfocus.com/bid/108485; https://support.f5.com/csp/article/K37428370; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html
CVE: CVE-2019-0132
Published: 2019-05-17
Description: Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/108388; https://support.lenovo.com/us/en/product_security/LEN-27709; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00228.html
CVE: CVE-2019-0138
Published: 2019-05-17
Description: Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html
CVE: CVE-2019-0153
Published: 2019-05-17
Description: Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.f5.com/csp/article/K71265658; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K71265658
CVE: CVE-2019-0170
Published: 2019-05-17
Description: Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://support.f5.com/csp/article/K51470205; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html; https://support.f5.com/csp/article/K51470205
CVE: CVE-2019-0171
Published: 2019-05-17
Description: Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://support.f5.com/csp/article/K33245306; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00244.html; https://support.f5.com/csp/article/K33245306
CVE: CVE-2019-0172
Published: 2019-05-17
Description: A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privilege via network access.
CVSS Score: 9.8 (CRITICAL)
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00245.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00245.html
CVE: CVE-2019-10139
Published: 2019-05-17
Description: During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-311, CWE-522
References: http://www.securityfocus.com/bid/108396; https://access.redhat.com/errata/RHSA-2019:2433; https://access.redhat.com/errata/RHSA-2019:2437
CVE: CVE-2019-11085
Published: 2019-05-17
Description: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00071.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html; http://www.securityfocus.com/bid/108488
CVE: CVE-2019-11093
Published: 2019-05-17
Description: Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html
CVE: CVE-2019-11094
Published: 2019-05-17
Description: Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00251.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00251.html
CVE: CVE-2019-11095
Published: 2019-05-17
Description: Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
References: https://support.f5.com/csp/article/K05525310; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00252.html; https://support.f5.com/csp/article/K05525310
CVE: CVE-2019-11114
Published: 2019-05-17
Description: Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00252.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00252.html
CVE: CVE-2019-4119
Published: 2019-05-17
Description: IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145.
CVSS Score: 5.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10878460; https://exchange.xforce.ibmcloud.com/vulnerabilities/158145; http://www.ibm.com/support/docview.wss?uid=ibm10878460
CVE: CVE-2019-4279
Published: 2019-05-17
Description: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.securityfocus.com/bid/108450; https://exchange.xforce.ibmcloud.com/vulnerabilities/160445; https://www.ibm.com/support/docview.wss?uid=ibm10883628
CVE: CVE-2019-5883
Published: 2019-05-17
Description: An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn't be allowed to.
CVSS Score: 9.1 (CRITICAL)
References: https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/; https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/
CVE: CVE-2019-5928
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via Customize Item function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/34279/; https://jvn.jp/en/jp/JVN58849431/
CVE: CVE-2019-5929
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the application 'Memo'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/34277/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5930
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application 'Management of Basic System'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/34227/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5931
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors.
CVSS Score: 8.7 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/34283/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5932
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the application 'Portal'.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/34276/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5933
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application 'Bulletin'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35307/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5934
Published: 2019-05-17
Description: SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35306/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5935
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35497/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5936
Published: 2019-05-17
Description: Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35484/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5937
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or HTML via the user information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35493/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5938
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Mail'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35494/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5939
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Portal'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35495/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5940
Published: 2019-05-17
Description: Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote attackers to inject arbitrary web script or HTML via the application 'Scheduler'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35490/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5941
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application 'Multi Report'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35489/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5942
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application 'Cabinet'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35485/; http://jvn.jp/en/jp/JVN58849431/index.html
CVE: CVE-2019-5943
Published: 2019-05-17
Description: Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application 'Bulletin' and the application 'Cabinet'.
CVSS Score: 4.3 (MEDIUM)
References: http://jvn.jp/en/jp/JVN58849431/index.html; https://kb.cybozu.support/article/35486/; http://jvn.jp/en/jp/JVN58849431/index.html