rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-18853 
ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to SVG and libxml2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T14:36:15.000Z
CVE-2019-18854 
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T14:36:02.000Z
CVE-2019-18855 
A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T14:35:49.000Z
CVE-2019-18856 
A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use element is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T14:35:14.000Z
CVE-2019-18857 
darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T14:34:59.000Z
CVE-2019-18858 
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-20T17:04:25.000Z
CVE-2019-18859 
Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T20:07:12.000Z
CVE-2019-18860 
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T20:32:16.000Z
CVE-2019-18862 
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-11T15:49:12.000Z
CVE-2019-18863 
A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercept sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T17:52:37.000Z
CVE-2019-18864 
/server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:01:35.000Z
CVE-2019-18865 
Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T12:56:26.000Z
CVE-2019-18866 
Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:03:01.000Z
CVE-2019-18867 
Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. This affects /ajax/, /common/, /engine/, /flash/, /images/, /Images/, /jscripts/, /lang/, /layout/, /programs/, and /sms/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T12:59:45.000Z
CVE-2019-18868 
Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T12:57:47.000Z
CVE-2019-18869 
Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:07:37.000Z
CVE-2019-18870 
A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:05:31.000Z
CVE-2019-18871 
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:06:36.000Z
CVE-2019-18872 
Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T13:04:24.000Z
CVE-2019-18873 
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T01:01:11.000Z
CVE-2019-18874 
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T01:30:29.000Z
CVE-2019-18881 
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T02:56:20.000Z
CVE-2019-18882 
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T02:56:10.000Z
CVE-2019-18883 
XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T19:55:05.000Z
CVE-2019-18884 
index.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding authorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T19:51:32.000Z
CVE-2019-18885 
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T13:53:44.000Z
CVE-2019-18886 
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T17:41:54.000Z
CVE-2019-18887 
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:18:04.000Z
CVE-2019-18888 
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:19:52.000Z
CVE-2019-18889 
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T22:21:42.000Z
CVE-2019-18890 
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T17:46:41.000Z
CVE-2019-18893 
XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T16:09:50.000Z
CVE-2019-18894 
In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-13T16:13:02.000Z
CVE-2019-18895 
Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-14T14:00:16.000Z
CVE-2019-18897 Local privilege escalation from user salt to root
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
vendor: openSUSE
product: Factory
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Johannes Segitz
Published: 2020-03-02T15:20:27.294Z
CVE-2019-18898 trousers: Local privilege escalation from tss to root
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP1
vendor: openSUSE
product: Factory
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Johannes Segitz from SUSE
Published: 2020-01-23T14:05:14.446Z
CVE-2019-18899 apt-cacher-ng insecure use of /run/apt-cacher-ng
The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: openSUSE
product: Leap 15.1
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2020-01-23T15:00:20.234Z
CVE-2019-18900 libzypp stores cookies world readable
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: SUSE
product: CaaS Platform 3.0
vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2020-01-24T15:15:15.806Z
CVE-2019-18901 mysql-systemd-helper allows setting 640 permissions of arbitrary files
A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: Matthias Gerstner
Published: 2020-03-02T16:10:13.772Z
CVE-2019-18902 wicked: Use-after-free when receiving invalid DHCP6 client options
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
vendor: openSUSE
product: Leap 15.1
vendor: openSUSE
product: Factory
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Malte Kraus
Published: 2020-03-02T16:45:18.218Z
CVE-2019-18903 wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
vendor: openSUSE
product: Leap 15.1
vendor: openSUSE
product: Factory
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Malte Kraus
Published: 2020-03-02T16:45:18.618Z
CVE-2019-18904 Migrations requests can cause DoS on rmt
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15-ESPOS
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15-LTSS
vendor: SUSE
product: SUSE Linux Enterprise Module for Public Cloud 15-SP1
vendor: SUSE
product: SUSE Linux Enterprise Module for Server Applications 15
vendor: SUSE
product: SUSE Linux Enterprise Module for Server Applications 15-SP1
vendor: SUSE
product: SUSE Linux Enterprise Server 15-LTSS
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 15
vendor: openSUSE
product: openSUSE Leap 15.1
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-04-03T07:10:13.137Z
CVE-2019-18905 Deprecated functionality in autoyast2 automatically imports gpg keys without checking them
A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2020-04-03T11:00:16.880Z
CVE-2019-18906 cryptctl: client side password hashing is equivalent to clear text password storage
A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 12-SP5
vendor: SUSE
product: SUSE Manager Server 4.0
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Malte Kraus of SUSE
Published: 2021-06-30T08:35:12.084Z
CVE-2019-18909 
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
Problem types: description: Privileged Command Injection
Affected products: vendor: HP
product: ThinPro Linux
Published: 2019-11-22T21:38:59.000Z
CVE-2019-18910 
The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges.
Problem types: description: Command Injection
Affected products: vendor: HP
product: ThinPro Linux
Published: 2019-11-22T21:23:52.000Z