rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-13535 Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure
In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States) version 1.20.2 and lower, the RFID security mechanism does not apply read protection, allowing for full read access of the RFID security mechanism data.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: Medtronic
product: Valleylab FT10 Energy Platform (VLFT10GEN)
default_status: unaffected
vendor: Medtronic
product: Valleylab LS10 Energy Platform (VLLS10GEN—not available in the United States)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Medtronic reported these vulnerabilities to CISA.
Published: 2019-11-08T19:45:55.000Z
CVE-2019-13536 
Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Delta Electronics
product: TPEditor
Published: 2019-09-11T20:49:37.000Z
CVE-2019-13537 
The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: AVEVA
product: Vijeo Citect and Citect SCADA
Published: 2020-01-14T18:05:51.000Z
CVE-2019-13538 
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: n/a
Published: 2019-09-17T19:04:54.000Z
CVE-2019-13539 Medtronic Valleylab FT10 and FX8 Reversible One-way Hash
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.
Problem types: cwe_id: CWE-328
description: CWE-328
Affected products: vendor: Medtronic
product: Valleylab Exchange Client
default_status: unaffected
vendor: Medtronic
product: Valleylab FT10 Energy Platform (VLFT10GEN)
default_status: unaffected
vendor: Medtronic
product: Valleylab FX8 Energy Platform (VLFX8GEN)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Medtronic reported these vulnerabilities to CISA.
Published: 2019-11-08T19:07:59.000Z
CVE-2019-13540 
Delta Electronics TPEditor, Versions 1.94 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Delta Electronics
product: TPEditor
Published: 2019-09-11T20:52:28.000Z
CVE-2019-13541 
In Horner Automation Cscape 9.90 and prior, an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Horner Automation Cscape
Published: 2019-10-18T18:26:35.000Z
CVE-2019-13542 
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.
Problem types: cwe_id: CWE-476
description: NULL POINTER DEREFERENCE CWE-476
Affected products: vendor: GmbH
product: 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server
Published: 2019-09-17T18:56:45.000Z
CVE-2019-13543 Medtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. If discovered, they can be used to read files on the device.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Medtronic
product: Valleylab Exchange Client
default_status: unaffected
vendor: Medtronic
product: Valleylab FT10 Energy Platform (VLFT10GEN)
default_status: unaffected
vendor: Medtronic
product: Valleylab FX8 Energy Platform (VLFX8GEN)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Medtronic reported these vulnerabilities to CISA.
Published: 2019-11-08T19:03:51.000Z
CVE-2019-13544 
Delta Electronics TPEditor, Versions 1.94 and prior. Multiple out-of-bounds write vulnerabilities may be exploited by processing specially crafted project files, which may allow remote code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: Delta Electronics
product: TPEditor
Published: 2019-09-11T20:45:39.000Z
CVE-2019-13545 
In Horner Automation Cscape 9.90 and prior, improper validation of data may cause the system to write outside the intended buffer area, which may allow arbitrary code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Horner Automation Cscape
Published: 2019-10-18T18:23:31.000Z
CVE-2019-13546 
In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host application user to break-out from the containment of the application and access unauthorized resources from the Windows operating system as the limited-access Windows user. Due to potential Windows vulnerabilities, it may be possible for additional attack methods to be used to escalate privileges on the operating system.
Problem types: cwe_id: CWE-668
description: EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668
Affected products: vendor: n/a
product: IntelliSpace Perinatal
Published: 2019-10-25T17:54:57.000Z
CVE-2019-13547 
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without authentication.
Problem types: cwe_id: CWE-862
description: MISSING AUTHORIZATION CWE-862
Affected products: vendor: n/a
product: Advantech WISE-PaaS/RMM
Published: 2019-10-31T20:59:00.000Z
CVE-2019-13548 
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: CODESYS V3 web server
Published: 2019-09-13T16:58:29.000Z
CVE-2019-13549 
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on and off and setting the temperature set point, can be modified without authentication.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: Rittal Chiller SK 3232-Series
Published: 2019-10-25T17:43:09.000Z
CVE-2019-13550 
In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of code, which may allow remote code execution or cause a system crash.
Problem types: cwe_id: CWE-285
description: IMPROPER AUTHORIZATION CWE-285
Affected products: vendor: n/a
product: WebAccess
Published: 2019-09-18T20:52:05.000Z
CVE-2019-13551 
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotely execute code while posing as an administrator.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: Advantech WISE-PaaS/RMM
Published: 2019-10-31T20:54:45.000Z
CVE-2019-13552 
In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.
Problem types: cwe_id: CWE-77
description: COMMAND INJECTION CWE-77
Affected products: vendor: n/a
product: WebAccess
Published: 2019-09-18T21:00:12.000Z
CVE-2019-13553 
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: Rittal Chiller SK 3232-Series
Published: 2019-10-25T17:46:47.000Z
CVE-2019-13554 
GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credentials. GE recommends that users disable the Telnet service.
Problem types: cwe_id: CWE-285
description: Improper Authorization CWE-285
Affected products: vendor: n/a
product: GE Mark VIe Controller
Published: 2020-04-07T17:01:44.000Z
CVE-2019-13555 
In Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: serial number 21081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 21081 and prior, MELSEC-L Series L02/06/26CPU, L26CPU-BT: serial number 21101 and prior, L02/06/26CPU-P, L26CPU-PBT: serial number 21101 and prior, and L02/06/26CPU-CM, L26CPU-BT-CM: serial number 21101 and prior, a remote attacker can cause the FTP service to enter a denial-of-service condition dependent on the timing at which a remote attacker connects to the FTP server on the above CPU modules.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: serial number 21081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 21081 and prior. MELSEC-L Series L02/06/26CPU, L26CPU-BT: serial number 21101 and prior, L02/06/26CPU-P, L26CPU-PBT: serial number 21101 and prior, and L02/06/26CPU-CM, L26CPU-BT-CM: serial number 21101 and prior.
Published: 2019-11-13T22:27:22.000Z
CVE-2019-13556 
In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: WebAccess
Published: 2019-09-18T21:05:50.000Z
CVE-2019-13557 
In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker to access system and configuration information.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: n/a
product: Tasy EMR
Published: 2019-11-08T17:26:53.000Z
CVE-2019-13558 
In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash.
Problem types: cwe_id: CWE-94
description: CODE INJECTION CWE-94
Affected products: vendor: n/a
product: WebAccess
Published: 2019-09-18T21:14:18.000Z
CVE-2019-13559 
GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the affected product may ship without setup and configuration instructions immediately available to the end user. The bulk of controllers go into applications requiring the GE commissioning engineer to change default configurations during the installation process. GE recommends that users reset controller passwords during installation in the operating environment.
Problem types: cwe_id: CWE-798
description: Hard-coded credentials CWE-798
Affected products: vendor: n/a
product: GE Mark VIe Controller
Published: 2020-04-07T17:03:47.000Z
CVE-2019-13560 
D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T14:59:02.000Z
CVE-2019-13561 
D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T14:59:14.000Z
CVE-2019-13562 
D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the /www/apply_sec.cgi html_response_return_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T14:59:27.000Z
CVE-2019-13563 
D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T14:59:38.000Z
CVE-2019-13564 
XSS exists in Ping Identity Agentless Integration Kit before 1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-11T17:14:29.000Z
CVE-2019-13565 
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T12:30:58.000Z
CVE-2019-13566 
An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow allows attackers to cause a denial of service and possibly execute arbitrary code via an IP address with a long hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T20:29:13.000Z
CVE-2019-13567 
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-12T03:00:51.000Z
CVE-2019-13568 
CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-31T14:17:12.000Z
CVE-2019-13569 
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T22:26:55.000Z
CVE-2019-13570 
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-23T16:16:47.000Z
CVE-2019-13571 
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T17:12:03.000Z
CVE-2019-13572 
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-01T14:35:57.000Z
CVE-2019-13573 
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T15:55:37.000Z
CVE-2019-13574 
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-12T02:31:25.000Z
CVE-2019-13575 
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T14:51:50.000Z
CVE-2019-13577 
SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T19:08:15.000Z
CVE-2019-13578 
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T15:36:43.000Z
CVE-2019-13581 
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary code via malformed Wi-Fi packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-15T20:26:41.000Z
CVE-2019-13582 
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-15T20:28:05.000Z
CVE-2019-13584 
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T18:58:56.000Z
CVE-2019-13585 
The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T18:51:35.000Z
CVE-2019-13588 
A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows remote attackers to inject arbitrary web script or HTML via the PagingStart parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-26T21:01:43.000Z
CVE-2019-13589 
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T15:03:37.000Z
CVE-2019-13590 
An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on the result of integer addition (wraparound to 0) fed into the lsx_calloc macro that wraps malloc. When a NULL pointer is returned, it is used without a prior check that it is a valid pointer, leading to a NULL pointer dereference on lsx_readbuf in formats_i.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T00:00:00.000Z
CVE-2019-13594 
In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T16:19:21.000Z
CVE-2019-13597 
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-14T17:05:35.000Z