rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6516 
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-14T14:50:37.000Z
CVE-2019-6517 
BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may allow for unauthorized access to administrative level functions.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: ICS-CERT
product: BD FACSLyric
Published: 2019-02-06T21:00:00.000Z
CVE-2019-6518 
Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.
Problem types: cwe_id: CWE-256
description: Unprotected storage of credentials CWE-256
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6519 
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T21:00:00.000Z
CVE-2019-6520 
Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes.
Problem types: cwe_id: CWE-284
description: Improper access control CWE-284
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6521 
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T21:00:00.000Z
CVE-2019-6522 
Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot.
Problem types: cwe_id: CWE-125
description: Out-of-bounds read CWE-125
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6523 
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-05T21:00:00.000Z
CVE-2019-6524 
Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack.
Problem types: cwe_id: CWE-307
description: Improper restriction of excessive authentication attempts CWE-307
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6525 
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
Affected products: vendor: AVEVA
product: Wonderware System Platform
Published: 2019-04-11T20:21:37.000Z
CVE-2019-6526 
Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password.
Problem types: cwe_id: CWE-311
description: Missing encryption of sensitive data CWE-311
Affected products: vendor: Moxa
product: IKS, EDS
Published: 2019-04-12T20:11:08.000Z
CVE-2019-6527 
PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: ICS-CERT
product: PR100088 Modbus gateway
Published: 2019-02-12T17:00:00.000Z
CVE-2019-6528 
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: ICS-CERT
product: PSI GridConnect GmbH (formerly known as PSI Nentec GmbH) Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy.
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6529 
An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Version 1.1.13166).
Problem types: description: Other
Affected products: vendor: n/a
product: PR100088 Modbus gateway
Published: 2020-01-07T20:21:54.000Z
CVE-2019-6530 
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows, which may lead to remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Panasonic
product: FPWIN Pro
Published: 2019-06-07T13:58:17.000Z
CVE-2019-6531 
An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) if the attacker is in an MITM position.
Problem types: cwe_id: CWE-598
description: INFORMATION EXPOSURE THROUGH QUERY STRINGS IN GET REQUEST CWE-598
Affected products: vendor: Kunbus
product: PR100088 Modbus gateway
Published: 2019-04-02T19:15:11.000Z
CVE-2019-6532 
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution.
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: Panasonic
product: FPWIN Pro
Published: 2019-06-07T13:58:48.000Z
CVE-2019-6533 
Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166).
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: ICS-CERT
product: PR100088 Modbus gateway
Published: 2019-02-12T17:00:00.000Z
CVE-2019-6534 
The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker to load and execute a malicious file.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: Gemalto
product: Sentinel UltraPro
Published: 2019-04-11T20:38:50.000Z
CVE-2019-6535 Mitsubishi Electric MELSEC-Q Series PLCs Resource Exhaustion
Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Mitsubishi Electric
product: Q03/04/06/13/26UDVCPU
default_status: unaffected
vendor: Mitsubishi Electric
product: Q04/06/13/26UDPVCPU
default_status: unaffected
vendor: Mitsubishi Electric
product: Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Tri Quach of Amazon's Customer Fulfillment Technology Security (CFTS) group reported this vulnerability to the National Cybersecurity and Communications Integration Center (NCCIC).
Published: 2019-02-05T19:00:00.000Z
CVE-2019-6536 
Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker to execute remote code in the context of the current process.
Problem types: cwe_id: CWE-787
description: Out-of-Bounds Write CWE-787
Affected products: vendor: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME
product: LAquis SCADA
Published: 2019-03-27T15:25:23.000Z
CVE-2019-6537 
Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow CWE-121
Affected products: vendor: ICS-CERT
product: WECON LeviStudioU
Published: 2019-02-13T00:00:00.000Z
CVE-2019-6539 
Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Problem types: cwe_id: CWE-122
description: Heap-based buffer overflow CWE-122
Affected products: vendor: ICS-CERT
product: WECON LeviStudioU
Published: 2019-02-13T00:00:00.000Z
CVE-2019-6540 Medtronic Conexus Radio Frequency Telemetry Protocol Cleartext Transmission of Sensitive Information
The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD, Primo ICD, Protecta ICD and CRT-D, Secura ICD, Virtuoso ICD, Virtuoso II ICD, Visia AF ICD, and Viva CRT-D does not implement encryption. An attacker with adjacent short-range access to a target product can listen to communications, including the transmission of sensitive data.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Medtronic
product: Conexus Radio Frequency Telemetry Protocol
default_status: unaffected
vendor: Medtronic
product: MyCareLink Monitor
default_status: unaffected
vendor: Medtronic
product: CareLink Monitor
default_status: unaffected
vendor: Medtronic
product: CareLink 2090 Programmer
default_status: unaffected
vendor: Medtronic
product: Amplia CRT-D
default_status: unaffected
vendor: Medtronic
product: Claria CRT-D
default_status: unaffected
vendor: Medtronic
product: Compia CRT-D
default_status: unaffected
vendor: Medtronic
product: Concerto CRT-D
default_status: unaffected
vendor: Medtronic
product: Concerto II CRT-D
default_status: unaffected
vendor: Medtronic
product: Consulta CRT-D
default_status: unaffected
vendor: Medtronic
product: Evera ICD
default_status: unaffected
vendor: Medtronic
product: Maximo II CRT-D
default_status: unaffected
vendor: Medtronic
product: Maximo II ICD
default_status: unaffected
vendor: Medtronic
product: Mirro ICD
default_status: unaffected
vendor: Medtronic
product: Nayamed ND ICD
default_status: unaffected
vendor: Medtronic
product: Primo ICD
default_status: unaffected
vendor: Medtronic
product: Protecta ICD, Protecta CRT-D
default_status: unaffected
vendor: Medtronic
product: Secura ICD
default_status: unaffected
vendor: Medtronic
product: Virtuoso ICD
default_status: unaffected
vendor: Medtronic
product: Virtuoso II ICD
default_status: unaffected
vendor: Medtronic
product: Visia AF ICD
default_status: unaffected
vendor: Medtronic
product: Viva CRT-D
default_status: unaffected
vendor: Medtronic
product: Brava CRT-D
default_status: unaffected
vendor: Medtronic
product: Mirro MRI ICD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Peter Morgan of Clever Security; Dave Singelée and Bart Preneel of KU Leuven; Eduard Marin formerly of KU Leuven, currently with University of Birmingham; Flavio D. Garcia; Tom Chothia of the University of Birmingham; and Rik Willems of University Hospital Gasthuisberg Leuven reported these vulnerabilities to CISA.
Published: 2019-03-26T17:47:23.000Z
CVE-2019-6541 
A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Problem types: cwe_id: CWE-119
description: Memory corruption CWE-119
Affected products: vendor: ICS-CERT
product: WECON LeviStudioU
Published: 2019-02-13T00:00:00.000Z
CVE-2019-6542 
ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated user to initiate a remote reboot, which may be used to cause a denial of service condition.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: ENTTEC
product: Datagate MK2
vendor: ENTTEC
product: Storm 24
vendor: ENTTEC
product: Pixelator
Published: 2019-03-28T13:50:25.000Z
CVE-2019-6543 
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: ICS-CERT
product: AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
Published: 2019-02-13T01:00:00.000Z
CVE-2019-6544 
GE Communicator, all versions prior to 4.0.517, has a service running with system privileges that may allow an unprivileged user to perform certain administrative actions, which may allow the execution of scheduled scripts with system administrator privileges. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROLS CWE-284
Affected products: vendor: n/a
product: GE Communicator
Published: 2019-05-09T14:51:24.000Z
CVE-2019-6545 
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.
Problem types: cwe_id: CWE-99
description: IMPROPER CONTROL OF RESOURCE IDENTIFIERS ('RESOURCE INJECTION') CWE-99
Affected products: vendor: ICS-CERT
product: AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
Published: 2019-02-13T01:00:00.000Z
CVE-2019-6546 
GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, which may allow an attacker to manipulate widgets and UI elements.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH CWE-427
Affected products: vendor: n/a
product: GE Communicator
Published: 2019-05-09T14:27:35.000Z
CVE-2019-6547 
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to lacking user input validation for processing project files.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: ICS-CERT
product: Delta Industrial Automation CNCSoft
Published: 2019-02-28T21:00:00.000Z
CVE-2019-6548 
GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This service is inaccessible to attackers if Windows default firewall settings are used by the end user.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: GE Communicator
Published: 2019-05-09T14:28:07.000Z
CVE-2019-6549 
An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) through FTP.
Problem types: cwe_id: CWE-312
description: CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312
Affected products: vendor: ICS-CERT
product: PR100088 Modbus gateway
Published: 2019-02-12T18:00:00.000Z
CVE-2019-6550 
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Advantech
product: WebAccess/SCADA
Published: 2019-04-05T18:09:34.000Z
CVE-2019-6551 
Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: ICS-CERT
product: Pangea Communications Internet FAX ATA
Published: 2019-02-28T21:00:00.000Z
CVE-2019-6552 
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.
Problem types: cwe_id: CWE-77
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND INJECTION') CWE-77
Affected products: vendor: Advantech
product: WebAccess/SCADA
Published: 2019-04-05T18:02:39.000Z
CVE-2019-6553 
A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where the data in a Forward Open service request is passed to a fixed size buffer, allowing an attacker to exploit a stack-based buffer overflow condition.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Rockwell Automation
product: RSLinx Classic
Published: 2019-04-04T18:59:09.000Z
CVE-2019-6554 
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: Advantech
product: WebAccess/SCADA
Published: 2019-04-05T18:15:35.000Z
CVE-2019-6555 
Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: ICS-CERT
product: Cscape
Published: 2019-02-28T20:00:00.000Z
CVE-2019-6556 
When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: Omron
product: CX-Programmer within CX-One
Published: 2019-04-10T19:48:50.000Z
CVE-2019-6557 
Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.
Problem types: cwe_id: CWE-120
description: Buffer overflow CWE-120
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6558 
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Problem types: cwe_id: CWE-521
description: WEAK PASSWORD REQUIREMENTS CWE-521
Affected products: vendor: n/a
product: Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)
Published: 2020-03-23T20:07:03.000Z
CVE-2019-6559 
Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash.
Problem types: cwe_id: CWE-400
description: Uncontrolled resource consumption CWE-400
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6560 
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Problem types: cwe_id: CWE-640
description: WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640
Affected products: vendor: n/a
product: Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App)
Published: 2020-03-23T19:37:33.000Z
CVE-2019-6561 
Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.
Problem types: cwe_id: CWE-352
description: Cross-site request forgery CWE-352
Affected products: vendor: ICS-CERT
product: Moxa IKS, EDS
Published: 2019-03-05T21:00:00.000Z
CVE-2019-6562 
In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: Philips
product: Philips Tasy EMR
Published: 2019-05-01T18:23:11.000Z