rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-9531 The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated, remote attacker to connect to this port via Telnet and execute 86 Attention (AT) commands, including some that provide unauthenticated, shell-like access to the device.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Cobham plc
product: Explorer 710
Credits: lang: en
value: This issue was found by Kyle O'Meara and David Belasco.
Published: 2019-10-10T20:09:47.705Z
CVE-2019-9532 The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext
The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local attacker to intercept the password and gain access to the portal.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Cobham plc
product: Explorer 710
Credits: lang: en
value: This issue was found by Kyle O'Meara and David Belasco.
Published: 2019-10-10T20:09:47.739Z
CVE-2019-9533 The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08
The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engineer the password from available versions to gain authenticated access to the device.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Cobham plc
product: Explorer 710
Credits: lang: en
value: This issue was found by Kyle O'Meara and David Belasco.
Published: 2019-10-10T20:09:47.781Z
CVE-2019-9534 The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Cobham plc
product: Explorer 710
Credits: lang: en
value: This issue was found by Kyle O'Meara and David Belasco.
Published: 2019-10-10T20:09:47.814Z
CVE-2019-9535 iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution
A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.
Problem types: cwe_id: CWE-349
description: CWE-349
Affected products: vendor: iTerm2
product: iTerm2
Credits: lang: en
value: Thanks to Stefan Grönke and Fabian Freyer of Radically Open Security for finding this vulnerability, the Mozilla Open Source Support (MOSS) project for supporting the audit, and George Nachman of iTerm2 for developing the fix, and all parties for coordinating this vulnerability.
Published: 2019-10-09T19:15:44.101Z
CVE-2019-9536 
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.
Problem types: description: insecure malloc implementation
Affected products: vendor: Apple
product: iPhone
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: axi0mX
Published: 2019-11-22T17:41:08.000Z
CVE-2019-9537 Telos Automated Message Handling System reflected XSS in uploaditem.asp
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:16.000Z
CVE-2019-9538 Telos Automated Message Handling System reflected XSS in LDAP cbURL parameter
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:16.000Z
CVE-2019-9539 Telos Automated Message Handling System reflected XSS in ModalWindowPopup.asp
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:17.000Z
CVE-2019-9540 Telos Automated Message Handling System reflected XSS in prefs.asp
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:17.000Z
CVE-2019-9541 Telos Automated Message Handling System information disclosure in itemlookup.asp
: Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:18.000Z
CVE-2019-9542 Telos Automated Message Handling System reflected XSS in itemlookup.asp
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Telos
product: Automated Message Handling System
Published: 2020-01-03T21:55:18.000Z
CVE-2019-9543 
An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T19:00:00.000Z
CVE-2019-9544 
An issue was discovered in Bento4 1.5.1-628. An out of bounds write occurs in AP4_CttsTableEntry::AP4_CttsTableEntry() located in Core/Ap4Array.h. It can be triggered by sending a crafted file to (for example) the mp42hls binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T19:00:00.000Z
CVE-2019-9545 
An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T19:00:00.000Z
CVE-2019-9546 
SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T22:00:00.000Z
CVE-2019-9547 
In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly detect such chains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-01T22:00:00.000Z
CVE-2019-9548 
Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T16:20:43.000Z
CVE-2019-9549 
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-03T19:00:00.000Z
CVE-2019-9550 
DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-03T19:00:00.000Z
CVE-2019-9551 
An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T04:00:00.000Z
CVE-2019-9552 
Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T04:00:00.000Z
CVE-2019-9553 
Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:18:51.000Z
CVE-2019-9554 
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:15:00.000Z
CVE-2019-9555 
Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T23:00:00.000Z
CVE-2019-9556 
FiberHome an5506-04-f RP2669 devices have XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T16:10:44.000Z
CVE-2019-9557 
Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-12T19:00:00.000Z
CVE-2019-9558 
Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-12T20:00:00.000Z
CVE-2019-9563 
In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T08:00:00.000Z
CVE-2019-9564 Authentication bypass in Wyze Cam Pan v2, Cam v2 and Cam v3
A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.
Problem types: description: authenti
Affected products: vendor: Wyze
product: Cam Pan v2
vendor: Wyze
product: Cam v2
vendor: Wyze
product: Cam v3
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Bitdefender Labs
Published: 2022-03-30T20:00:17.107Z
CVE-2019-9565 
Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T08:00:00.000Z
CVE-2019-9566 
FlarumChina v0.1.0-beta.7C has SQL injection via a /?q= request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T18:00:00.000Z
CVE-2019-9567 
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T18:00:00.000Z
CVE-2019-9568 
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-04T18:00:00.000Z
CVE-2019-9569 
Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T19:35:10.000Z
CVE-2019-9570 
An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T14:00:00.000Z
CVE-2019-9572 
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the _Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of arbitrary PHP code in Public\Home\1_Static.php because of mishandling in the Application\Admin\Controller\ThemeController.class.php Upload() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T14:00:00.000Z
CVE-2019-9573 
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T21:00:00.000Z
CVE-2019-9574 
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T21:00:00.000Z
CVE-2019-9575 
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T21:00:00.000Z
CVE-2019-9576 
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T21:00:00.000Z
CVE-2019-9578 
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-05T23:00:00.000Z
CVE-2019-9579 
An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g., an attacker with WRITE_XATTR can change permissions. This occurs because of a combination of three factors: ZFS extended attributes are used to implement NT named streams, the SMB protocol requires implementations to have open handle semantics similar to those of NTFS, and the SMB server passes along certain attribute requests to the underlying object (i.e., they are not considered to be requests that pertain to the named stream).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2019-9580 
In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-09T04:00:00.000Z
CVE-2019-9581 
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T00:00:00.000Z
CVE-2019-9582 
eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T19:57:14.000Z
CVE-2019-9583 
eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15. Affected versions for CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T19:47:54.000Z
CVE-2019-9584 
eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to improper access control for all /addons/mh/ pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T20:03:06.000Z
CVE-2019-9585 
eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in the ability to read, set and deletion of Metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T20:10:17.000Z
CVE-2019-9587 
There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T08:00:00.000Z
CVE-2019-9588 
There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T08:00:00.000Z
CVE-2019-9589 
There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T08:00:00.000Z
CVE-2019-9590 
An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure mode) by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 (aka UID 0x43) requests to TCP port 502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T16:00:00.000Z
CVE-2019-9591 
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T16:00:00.000Z
CVE-2019-9592 
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T16:00:00.000Z
CVE-2019-9593 
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T16:00:00.000Z
CVE-2019-9594 
BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-06T16:00:00.000Z