rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-17058 
Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T15:19:54.000Z
CVE-2019-17059 
A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T16:45:57.000Z
CVE-2019-17060 
The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:11:18.000Z
CVE-2019-17061 
The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:17:23.000Z
CVE-2019-17062 
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T15:24:34.000Z
CVE-2019-17063 
In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:14:38.000Z
CVE-2019-17064 
Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:22:44.000Z
CVE-2019-17066 
In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives (HKCU) when starting an application with elevated rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T21:53:20.000Z
CVE-2019-17067 
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:55:36.000Z
CVE-2019-17068 
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:55:28.000Z
CVE-2019-17069 
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T00:00:00.000Z
CVE-2019-17070 
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T10:51:18.000Z
CVE-2019-17071 
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T10:51:54.000Z
CVE-2019-17072 
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T10:52:22.000Z
CVE-2019-17073 
emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T19:06:54.000Z
CVE-2019-17074 
An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T19:06:42.000Z
CVE-2019-17075 
An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T20:07:51.000Z
CVE-2019-17076 
An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in several APIs may cause Denial of Service (DoS), remote code execution (RCE), and/or deletion of files on the Jamf Pro server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T15:57:07.000Z
CVE-2019-17080 
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T12:17:42.000Z
CVE-2019-17082 
Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system

the vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password.

This issue affects AccuRev: 2017.1.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: OpenText™
product: AccuRev
default_status: unaffected
Published: 2024-11-26T19:31:57.665Z
CVE-2019-17085 
XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent.
Problem types: description: XXE attack
Affected products: vendor: Micro Focus International
product: Operations Agent
Published: 2019-11-18T20:16:28.000Z
CVE-2019-17087 
Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under.
Problem types: description: Unauthorized file download.
Affected products: vendor: Micro Focus International
product: AcuToWeb
Published: 2019-12-11T22:11:30.000Z
CVE-2019-17091 
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T13:58:49.000Z
CVE-2019-17092 
An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T18:22:45.000Z
CVE-2019-17093 
An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:59:08.000Z
CVE-2019-17094 Stack-Based Overflow vulnerability in Belkin WeMo Insights Switch
A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and prior versions.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Belkin
product: Belkin WeMo Insight Switch
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2020-01-27T17:14:09.103Z
CVE-2019-17095 Bitdefender BOX 2 bootstrap download_image command injection vulnerability
A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In order to exploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Bitdefender
product: Bitdefender BOX 2
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos
Published: 2020-01-27T17:20:14.173Z
CVE-2019-17096 Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Bitdefender
product: Bitdefender BOX 2
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos.
Published: 2020-01-28T13:39:04.353Z
CVE-2019-17098 Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge App
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: August
product: Smart Lock and Connect Wi-Fi Bridge App
vendor: August
product: Connect Firmware
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2020-09-30T13:05:16.276Z
CVE-2019-17099 Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)
An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Bitdefender
product: EPSecurityService.exe
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Bugcrowd user khangkito
Published: 2020-01-27T17:23:06.763Z
CVE-2019-17100 Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Bitdefender
product: bdserviceshost.exe
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-01-27T13:55:17.731Z
CVE-2019-17101 Command execution due to unsanitized input in Netatmo Smart Indoor Security Camera
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor Camera version and prior versions.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Netatmo
product: Smart Indoor Camera
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2020-04-23T18:35:12.264Z
CVE-2019-17102 Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.
Problem types: cwe_id: CWE-413
description: CWE-413: Improper Resource Locking
Affected products: vendor: Bitdefender
product: Bitdefender BOX 2
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Bugcrowd user Mongo
Published: 2020-01-27T14:05:23.586Z
CVE-2019-17103 Get-task-allow entitlement via BDLDaemon on macOS
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Bitdefender
product: Bitdefender AV for Mac
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Bugcrowd user Bohops
Published: 2020-01-27T14:10:17.721Z
CVE-2019-17104 
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:19:30.000Z
CVE-2019-17105 
The token generator in index.php in Centreon Web before 2.8.27 is predictable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T14:35:17.000Z
CVE-2019-17106 
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:21:04.000Z
CVE-2019-17107 
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:24:04.000Z
CVE-2019-17108 
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:25:07.000Z
CVE-2019-17109 
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T21:30:22.000Z
CVE-2019-17112 
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-09T19:40:52.000Z
CVE-2019-17113 
In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-03T23:57:36.000Z
CVE-2019-17114 
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scripting occurs immediately after a .csv file is uploaded. The malicious script is stored and can be executed again when the List Pre-Registration functionality is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:44:18.000Z
CVE-2019-17115 
Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The rendered_message column is retrieved and displayed, unsanitized, on Logs.jsp. A remote attack can populate the rendered_message column with malicious values via: (1) H parameter to /wikid/servlet/com.wikidsystems.server.GetDomainHash (2) S parameter to: - /wikid/DomainData - /wikid/PreRegisterLookup - /wikid/PreRegister - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES (3) a parameter to: - /wikid/PreRegisterLookup - /wikid/InitDevice - /wikid/servlet/InitDevice2S - /wikid/servlet/InitDevice3S - /servlet/com.wikidsystems.server.InitDevice2S - /servlet/com.wikidsystems.server.InitDevice3S - /servlet/com.wikidsystems.server.InitDevice4S - /wikid/servlet/com.wikidsystems.server.InitDevice4AES - /wikid/servlet/com.wikidsystems.server.InitDevice5AES.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:46:09.000Z
CVE-2019-17116 
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately after the group is created. The malicious script is stored and will be executed again whenever /WiKIDAdmin/groups.jsp is visited.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:47:50.000Z
CVE-2019-17117 
A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:50:11.000Z
CVE-2019-17118 
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T17:59:50.000Z
CVE-2019-17119 
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T18:08:05.000Z
CVE-2019-17120 
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-17T18:10:16.000Z
CVE-2019-17121 
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-04T02:29:27.000Z