rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10964 Medtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access Control
Medtronic MiniMed Insulin Pumps

 are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with adjacent access to one of the affected insulin pump models can inject, replay, modify, and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Medtronic
product: MiniMed 508 pump
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 511 pump
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 512/712 pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 712E pump
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 515/715 pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 522/722 pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 522K/722K pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 523/723 pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm 523K/723K pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm Veo 554/754 pumps
default_status: unaffected
vendor: Medtronic
product: MiniMed Paradigm Veo 554CM/754CM pumps
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Based on earlier work performed by external researchers including Nathanael Paul, Jay Radcliffe, and Barnaby Jack, and from recent work performed by external researchers Billy Rios, Jonathan Butts, and Jesse Young, Medtronic performed additional variant analysis and reported this vulnerability
Published: 2019-06-28T20:58:07.000Z
CVE-2019-10965 
In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service, which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.
Problem types: description: Buffer Overflow
Affected products: vendor: Emerson
product: Emerson Ovation OCR400 Controller
Published: 2019-05-28T21:54:26.000Z
CVE-2019-10966 
In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP network configuration, which could allow an attacker to remotely modify device configuration and silence alarms.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: GE
product: Aestiva and Aespire
Published: 2019-07-10T17:52:23.000Z
CVE-2019-10967 
In Emerson Ovation OCR400 Controller 3.3.1 and earlier, a stack-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long file name from the LIST command to the FTP service, which may cause the service to overwrite buffers, leading to remote code execution and escalation of privileges.
Problem types: cwe_id: CWE-121
description: Stack-Based Buffer Overflow CWE-121
Affected products: vendor: Emerson
product: Emerson Ovation OCR400 Controller
Published: 2019-05-28T21:59:06.000Z
CVE-2019-10968 
Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled.
Problem types: cwe_id: CWE-477
description: USE OF OBSOLETE FUNCTION CWE-477
Affected products: vendor: Philips
product: Philips Holter 2010 Plus
Published: 2019-07-24T14:46:14.000Z
CVE-2019-10969 
Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may allow an attacker to perform remote code execution.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Moxa EDR 810
Published: 2019-10-08T18:41:28.000Z
CVE-2019-10970 
In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, unauthenticated threat actor with access to an affected PanelView 5510 Graphic Display, upon successful exploit, may boot-up the terminal and gain root-level access to the device’s file system.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: n/a
product: Rockwell Automation PanelView 5510
Published: 2019-07-11T19:51:27.000Z
CVE-2019-10971 
The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.
Problem types: cwe_id: CWE-426
description: UNTRUSTED SEARCH PATH CWE-426
Affected products: vendor: n/a
product: Network Configurator for DeviceNet Safety
Published: 2019-06-12T15:03:59.000Z
CVE-2019-10972 
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project file (.frc2). Once a user opens the rogue project, CPU exhaustion occurs, which causes the software to quit responding until the application is restarted.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION CWE-400
Affected products: vendor: Mitsubishi Electric
product: Mitsubishi Electric FR Configurator2
Published: 2019-07-25T23:31:47.000Z
CVE-2019-10973 
Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting tools located in the administrator user interface.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Quest KACE
Published: 2019-07-08T17:25:30.000Z
CVE-2019-10974 
NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten with arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: National Renewable Energy Laboratory (NREL)
product: EnergyPlus
Published: 2019-07-25T23:37:50.000Z
CVE-2019-10975 
An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: Fuji Electric
product: Alpha7 PC Loader
Published: 2019-07-02T19:15:15.000Z
CVE-2019-10976 
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
Problem types: cwe_id: CWE-611
description: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Affected products: vendor: Mitsubishi Electric
product: Mitsubishi Electric FR Configurator2
Published: 2019-07-25T23:27:48.000Z
CVE-2019-10977 
In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP service, forcing the target devices to enter an error mode and cause a denial-of-service condition.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION CWE-400
Affected products: vendor: Mitsubishi Electric
product: MELSEC-Q series Ethernet module
Published: 2019-05-23T13:28:22.000Z
CVE-2019-10978 
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area.
Problem types: cwe_id: CWE-119
description: IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119
Affected products: vendor: n/a
product: Red Lion Controls Crimson (Windows configuration software)
Published: 2019-09-23T15:58:32.000Z
CVE-2019-10979 
SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: SICK
product: MSC800
Published: 2019-07-01T20:05:10.000Z
CVE-2019-10980 
A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute remote code. The attacker must have local access to the system. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: n/a
product: LCDS LAquis SCADA
Published: 2019-08-05T18:39:38.000Z
CVE-2019-10981 
In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials CWE-522
Affected products: vendor: AVEVA
product: AVEVA Vijeo Citect and CitectSCADA
Published: 2019-05-31T20:59:47.000Z
CVE-2019-10982 
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Delta Electronics
product: CNCSoft ScreenEditor
Published: 2019-07-24T14:51:27.000Z
CVE-2019-10983 
In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information.
Problem types: description: Other
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:38:08.000Z
CVE-2019-10984 
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers.
Problem types: cwe_id: CWE-465
description: POINTER ISSUES CWE-465
Affected products: vendor: n/a
product: Red Lion Controls Crimson (Windows configuration software)
Published: 2019-09-23T15:58:41.000Z
CVE-2019-10985 
In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability to delete files while posing as an administrator.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:05:33.000Z
CVE-2019-10987 
In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.
Problem types: description: Other
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:49:28.000Z
CVE-2019-10988 
In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultrasound System is built on an old operating system that is no longer supported. Thus, any unmitigated vulnerability in the old operating system could be exploited to affect this product.
Problem types: cwe_id: CWE-477
description: USE OF OBSOLETE FUNCTION CWE-477
Affected products: vendor: n/a
product: Philips HDI 4000 Ultrasound Systems
Published: 2019-09-04T13:36:31.000Z
CVE-2019-10989 
In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-10991.
Problem types: description: Buffer Overflow
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:31:48.000Z
CVE-2019-10990 
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
Problem types: cwe_id: CWE-321
description: USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321
Affected products: vendor: n/a
product: Red Lion Controls Crimson (Windows configuration software)
Published: 2019-09-23T15:46:43.000Z
CVE-2019-10991 
In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.
Problem types: description: Buffer Overflow
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:25:56.000Z
CVE-2019-10992 
Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclosure due to lacking user input validation for processing project files.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: Delta Electronics
product: CNCSoft ScreenEditor
Published: 2019-07-24T14:55:19.000Z
CVE-2019-10993 
In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code.
Problem types: description: Other
Affected products: vendor: WebAccess
product: WebAccess/SCADA
Published: 2019-06-28T20:52:48.000Z
CVE-2019-10994 
Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive information. The attacker must have local access to the system. A CVSS v3 base score of 2.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: LCDS LAquis SCADA
Published: 2019-08-05T18:41:18.000Z
CVE-2019-10995 
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: ABB CP651 HMI products
Published: 2020-01-14T16:20:10.000Z
CVE-2019-10996 
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that can reference memory after it has been freed.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: Red Lion Controls Crimson (Windows configuration software)
Published: 2019-09-23T15:58:11.000Z
CVE-2019-10997 
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be restarted manually via a Linux shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T17:59:18.000Z
CVE-2019-10998 
An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T12:10:17.000Z
CVE-2019-10999 
The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated attacker to execute arbitrary code by providing a long string in the WEPEncryption parameter when requesting wireless.htm. Vulnerable devices include DCS-5009L (1.08.11 and below), DCS-5010L (1.14.09 and below), DCS-5020L (1.15.12 and below), DCS-5025L (1.03.07 and below), DCS-5030L (1.04.10 and below), DCS-930L (2.16.01 and below), DCS-931L (1.14.11 and below), DCS-932L (2.17.01 and below), DCS-933L (1.14.11 and below), and DCS-934L (1.05.04 and below).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-06T19:30:57.000Z
CVE-2019-11000 
An issue was discovered in GitLab Enterprise Edition before 11.7.11, 11.8.x before 11.8.7, and 11.9.x before 11.9.7. It allows Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-10T19:43:22.000Z
CVE-2019-11001 
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and run OS commands as root, as demonstrated by shell metacharacters in the addr1 field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T17:00:21.000Z
CVE-2019-11002 
In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T17:45:45.000Z
CVE-2019-11003 
In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T17:45:54.000Z
CVE-2019-11004 
In Materialize through 1.0.0, XSS is possible via the Toast feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T17:46:08.000Z
CVE-2019-11005 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a quoted font family value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:17:26.000Z
CVE-2019-11006 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of coders/miff.c, which allows attackers to cause a denial of service or information disclosure via an RLE packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:17:37.000Z
CVE-2019-11007 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the ReadMNGImage function of coders/png.c, which allows attackers to cause a denial of service or information disclosure via an image colormap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:18:08.000Z
CVE-2019-11008 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:18:18.000Z
CVE-2019-11009 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadXWDImage of coders/xwd.c, which allows attackers to cause a denial of service or information disclosure via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:18:30.000Z
CVE-2019-11010 
In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a memory leak in the function ReadMPCImage of coders/mpc.c, which allows attackers to cause a denial of service via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T18:18:44.000Z
CVE-2019-11011 
Akamai CloudTest before 58.30 allows remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-21T17:55:21.000Z
CVE-2019-11013 
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:41:40.000Z
CVE-2019-11014 
The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS, and Windows), do not prevent spoofing of the camera server. An attacker can create a fake camera server that listens for the client looking for a camera on the local network. When the camera responds to the client, it responds via the broadcast address, giving all information necessary to impersonate the camera. The attacker then floods the client with responses, causing the original camera to be denied service from the client, and thus causing the client to then communicate exclusively with the attacker's fake camera server. When connecting to the fake camera server, the client sends all details necessary to login to the camera (username and password).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T19:44:56.000Z
CVE-2019-11015 
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-18T21:51:29.000Z
CVE-2019-11016 
Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T20:13:25.000Z
CVE-2019-11017 
On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-18T17:54:02.000Z
CVE-2019-11018 
application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T20:37:08.000Z
CVE-2019-11019 
Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easily guessable exportpdf/all_claim_detail.php?claim_id= URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T15:43:43.000Z