vendor: auo

summary: An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password in the WWW-Authenticate attribute. By using this account and password, anyone can login successfully.


status: affected

ecosystem: software/application

metric_type: Primary

severity: medium

severity: low

part: a

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.


ecosystem: operating-system

severity: high

part: o

vendor: carel

summary: An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device.


summary: Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.


severity: critical

summary: BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow via a long prefix that is mishandled in bns_fasta2bntseq and bns_dump at btnseq.c.

title: Burrow-Wheeler Aligner Project Burrow-Wheeler Aligner security vulnerability


product: mediainfo

vendor: mediaarea

product: fedora

vendor: fedoraproject

summary: An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.

title: Mediaarea Mediainfo security vulnerability


summary: An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.


summary: 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.


product: msvod

vendor: meisivod

summary: Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.


vendor: brassica

summary: SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own.


product: wcms

vendor: wcms

summary: wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.

title: Wcms security vulnerability


product: projectsend

vendor: projectsend

summary: An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.


archetype: generic

vendor: estrongs

summary: The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.android.pop.ftp.ESFtpShortcut intent, leading to remote FTP access to the entirety of local storage.

title: Estrongs Es File Explorer File Manager security vulnerability


summary: An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/password of a valid user via /data/data/com.medhaapps.wififtpserver/shared_prefs/com.medhaapps.wififtpserver_preferences.xml


product: zalora

vendor: zalora

summary: The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), which allows a non-root user to find out the username/password of a valid user via /data/data/com.zalora.android/shared_prefs/login_data.xml.


vendor: modsecurity

summary: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.


summary: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity


summary: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with next# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity


summary: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with set_error_handler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity


summary: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with $a# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity


archetype: xxe

vendor: dotnetblogengine

summary: BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.


product: monit

vendor: tildeslash

summary: An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter.


product: mailcarrier

vendor: tabslab

summary: A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO, POP3 USER, POP3 LIST, POP3 TOP, or POP3 RETR.

title: Tabslab Mailcarrier security vulnerability


vendor: avira

summary: An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to obtain SYSTEM privileges. Arbitrary file creation can be achieved by abusing the SwuConfig.json file creation: an unprivileged user can replace these files by pseudo-symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory.


vendor: rapidflows

vendor: microsoft

summary: GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter.

title: Rapidflows Rapid4 security vulnerability


product: ulicms

vendor: ulicms

summary: Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.

title: Ulicms security vulnerability


vendor: trendnet

summary: An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp lanHostCfg_HostName_1.1.1.0.0 parameter.


summary: An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. A buffer overflow occurs through the get_set.ccp ccp_act parameter.


vendor: siteserver

summary: A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.


product: enterprise

vendor: gradle

summary: In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format.


summary: In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page.

title: Gradle Build Cache Node security vulnerability


metric_type: Secondary

product: arrow

vendor: arrow-kt

summary: arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.


vendor: openapi-generator

summary: OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.

title: Openapi-Generator Openapi Generator security vulnerability


vendor: intelliants

summary: Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.


product: fusionpbx

vendor: fusionpbx

summary: app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.

title: Fusionpbx security vulnerability


ecosystem: javascript/npm

summary: XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.

title: Fusionpbx security vulnerability


summary: app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

title: Fusionpbx security vulnerability


summary: app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host.

title: Fusionpbx security vulnerability


product: mujs

vendor: artifex

summary: An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.


vendor: fedoraproject

summary: An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDTRY opcode call.


summary: An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check.


vendor: intelbras

summary: An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete control of the router.


summary: An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause a denial of service (reboot), as demonstrated by JSON misparsing of the \""} string to v1/system/login.


summary: A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/user.

title: Intelbras Iwr 3000N Firmware security vulnerability


summary: system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68.

title: Trendnet Tv-Ip110Wn Firmware security vulnerability


summary: apply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to the SOAPACTION:HNAP1 interface.


product: wechat

vendor: tencent

summary: vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone's IMEI. The crash occurs upon receiving a message that contains the replaced emoji.

title: Tencent Wechat security vulnerability


product: icms

vendor: idreamsoft

summary: An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter.

title: Idreamsoft Icms security vulnerability


summary: An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter.


vendor: scilico

summary: I, Librarian 4.10 has XSS via the export.php export_files parameter.


product: webpanel

vendor: control-webpanel

summary: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.

title: Control-Webpanel Webpanel security vulnerability


vendor: liferay

summary: An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw


product: openkm

vendor: openkm

summary: OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges.

title: Openkm security vulnerability


product: atutor

vendor: atutor

summary: An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.


product: cutenews

vendor: cutephp

summary: An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)


vendor: zohocorp

summary: An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file.


summary: I, Librarian 4.10 has XSS via the notes.php notes parameter.


product: whatsns

vendor: whatsns

summary: whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.


summary: whatsns 4.0 allows index.php?inform/add.html qid SQL injection.


summary: whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.


vendor: mmonit

vendor: canonical

vendor: debian

product: fedora

summary: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

title: Mmonit Monit security vulnerability


vendor: tildeslash

summary: A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).

title: Tildeslash Monit security vulnerability


vendor: gilacms

summary: Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.


vendor: micropyramid

summary: Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.

title: Micropyramid Django Crm security vulnerability


product: cakephp

vendor: cakephp

summary: An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.


product: evince

vendor: gnome

vendor: fedoraproject

vendor: redhat

summary: The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

title: Gnome Evince security vulnerability


product: gnome-desktop

summary: An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.


product: nautilus

summary: An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.


product: libarchive

vendor: libarchive

summary: A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.

title: Libarchive security vulnerability


vendor: couchbase

summary: Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092).


summary: An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted.


summary: In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access.

title: Couchbase Couchbase Server security vulnerability


summary: In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input.


summary: Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature.


product: imagemagick

vendor: imagemagick

summary: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.

title: Imagemagick security vulnerability


product: libheif

vendor: struktur

summary: libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.

title: Struktur Libheif security vulnerability


summary: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.

title: Imagemagick security vulnerability


product: graphicsmagick

vendor: graphicsmagick

summary: coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (out-of-bounds read and application crash) by crafting an XWD image file, a different vulnerability than CVE-2019-11008 and CVE-2019-11009.

title: Graphicsmagick security vulnerability


vendor: opensuse

product: leap

summary: coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (floating-point exception and application crash) by crafting an XWD image file, a different vulnerability than CVE-2019-11008 and CVE-2019-11009.

title: Graphicsmagick security vulnerability


product: Whoopsie

vendor: Ubuntu

version: before 0.2.52.5ubuntu0.1

version: before 0.2.62ubuntu0.1

version: before 0.2.64ubuntu0.1

version: before 0.2.66

summary: An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in the context of the whoopsie process.

title: Canonical Ubuntu Linux security vulnerability


product: Linux kernel

vendor: Linux

version_type: custom

ecosystem: linux/kernel

vendor: linux

summary: Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.

title: F5 Big-Ip Advanced Firewall Manager security vulnerability


summary: Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.


summary: Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.


product: pc-kernel

vendor: Canonical

version: unspecified

product: c-kernel

vendor: canonical

summary: The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16

title: Canonical C-Kernel security vulnerability


product: apport

summary: Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.


summary: Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.

title: Apport Project Apport security vulnerability


summary: Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user.


product: whoopsie

summary: Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.


vendor: debian

vendor: netapp

summary: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.


summary: The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.

title: Linux Linux Kernel security vulnerability


product: simplybook

vendor: simplybook

summary: Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history.

title: Simplybook security vulnerability


summary: Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-Priv Users to Elevate Privileges to Full Admin Rights via a crafted HTTP PUT Request, as demonstrated by modified JSON data to a /v2/rest/ URI.

title: Simplybook security vulnerability


ecosystem: windows/system

product: npcap

vendor: nmap

summary: An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges.

title: An issue was discovered in Npcap 0.992


product: projectsend

vendor: projectsend

summary: ProjectSend before r1070 writes user passwords to the server logs.


product: verypdf

vendor: verypdf

summary: VeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator in pdfocx.ocx (used by pdfeditor.exe and pdfcmd.exe) is mishandled.

title: Verypdf security vulnerability


product: dovecot

vendor: dovecot

product: fedora

vendor: fedoraproject

summary: In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command.

title: Dovecot security vulnerability


vendor: couchbase

summary: In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remote system. This has been fixed in version 6.0.0.


summary: In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0.


summary: In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate.


product: wavpack

vendor: wavpack

summary: WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.

title: Wavpack security vulnerability


summary: In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message.

title: Dovecot security vulnerability


product: pigeonhole

summary: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution.


product: snapd

summary: snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory.


summary: snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."

title: Canonical Snapd security vulnerability


product: zotonic

vendor: zotonic

summary: Zotonic before version 0.47 has mod_admin XSS.


product: graphicsmagick

vendor: graphicsmagick

vendor: opensuse

product: leap

summary: In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.

title: Graphicsmagick security vulnerability


summary: In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.

title: Graphicsmagick security vulnerability


vendor: ivanti

summary: In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page.

title: Ivanti Connect Secure security vulnerability


summary: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.


summary: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.


business_risk: Critical, internet-reachable appliance vulnerability. An unauthenticated remote attacker can exploit Pulse Connect Secure to read arbitrary files, potentially exposing sensitive configuration, credentials, and session information. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog.

claim: CVE-2019-11510 affects Pulse Secure Pulse Connect Secure, also associated with Ivanti Connect Secure.

claim: Affected versions are Pulse Connect Secure 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4.

claim: An unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.

kind: exposure

claim: CISA describes the vulnerability as exploitable by an unauthenticated remote attacker with network access via HTTPS and lists it in the Known Exploited Vulnerabilities Catalog.

claim: The fixed baselines are 8.2R12.1, 8.3R7.1, and 9.0R3.4 or later.

claim: Ivanti release documentation references Pulse Connect Secure 9.0R3.4 and 8.3R7.1 as supported release levels.

claim: CISA's required action for this KEV entry is to apply updates according to vendor instructions.

kind: remediation

claim: Comparing the installed appliance release/build with the fixed version baselines is a supported inert verification approach based on the authoritative affected and fixed version information.

kind: verification

exposure_conditions: The affected product is Pulse Secure Pulse Connect Secure, now associated with Ivanti Connect Secure.

exposure_conditions: Exposure requires a vulnerable appliance reachable by the attacker over the network, including HTTPS access to the appliance.

exposure_conditions: Affected release branches are 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4.

exposure_conditions: The vulnerability is remotely exploitable without authentication according to the current NVD description.

remediation_steps: Identify all Pulse Connect Secure/Ivanti Connect Secure appliances and record their installed release and build information.

remediation_steps: Upgrade affected 8.2 appliances to 8.2R12.1 or later, affected 8.3 appliances to 8.3R7.1 or later, and affected 9.0 appliances to 9.0R3.4 or later, following the vendor's supported upgrade procedure.

remediation_steps: If an affected appliance cannot be upgraded immediately, restrict access to trusted administrative or remote-access networks and apply compensating controls consistent with Ivanti/CISA guidance.

remediation_steps: Because the vulnerability is known to be exploited, prioritize emergency remediation and review relevant appliance, authentication, and network logs for signs of unauthorized access.

status: complete

uncertainty: The supplied record contains generic n/a affected-product data, while the NVD description identifies the affected product and version ranges; product matching should therefore be validated against local inventory.

uncertainty: The vendor advisory URL supplied in the record is currently marked as a broken link by NVD, so detailed vendor-specific upgrade workflow and rollback requirements were not independently confirmed.

uncertainty: No safe, vendor-provided non-exploit detection procedure for confirming absence of the flaw was located; verification is consequently limited to release/build validation and authorized inventory scanning.

verification_steps: Review the appliance's administrative version/build information and confirm it is at or above the applicable fixed release: 8.2R12.1, 8.3R7.1, or 9.0R3.4.

verification_steps: Confirm the upgrade completed successfully through the appliance's normal administrative status or release-reporting mechanism.

verification_steps: Re-scan the asset using an authorized authenticated inventory or vulnerability-management check that identifies the installed product release; do not perform exploit-based testing against production systems.

verification_steps: Verify that the remediated appliance is no longer identified as running an affected release by the organization's asset and vulnerability records.

known_ransomware_campaign_use: Known

notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2019-11510

product: Pulse Connect Secure

required_action: Apply updates per vendor instructions.

vendor_project: Ivanti

vulnerability_name: Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

status: Analyzed

summary: In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .


vendor: zohocorp

summary: Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.


product: contao

vendor: contao

summary: Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.

title: Contao 4.x allows SQL Injection


vendor: cmsmadesimple

summary: The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.


product: flarum

vendor: flarum

summary: User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.


vendor: gilacms

summary: core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.


product: android

vendor: google

summary: An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry Responses (EIRs) are improperly handled, which causes a heap-based buffer overflow during device inquiry. This overflow can be used to overwrite existing functions with arbitrary code. The Reserved for Future Use (RFU) bits are not discarded by eir_handleRx(), and are included in an EIR's length. Therefore, one can exceed the expected 240 bytes, which leads to a heap-based buffer overflow in eir_getReceivedEIR() called by bthci_event_SendInquiryResultEvent(). In order to exploit this bug, an attacker must repeatedly connect to the victim's device in a short amount of time from different source addresses. This will cause the victim's Bluetooth stack to resolve the device names and therefore allocate buffers with attacker-controlled data. Due to the heap corruption, the name will be eventually written to an attacker-controlled location, leading to a write-what-where condition.


product: wampserver

vendor: wampserver

summary: WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner.

title: Wampserver security vulnerability


product: semcms

vendor: sem-cms

summary: An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protection mechanism is incomplete.

title: An issue was discovered in SEMCMS 3.8


product: nopcommerce

vendor: nopcommerce

summary: Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.

title: Nopcommerce security vulnerability


vendor: open-xchange

summary: OX App Suite 7.10.1 allows Content Spoofing.


summary: OX App Suite 7.10.0 to 7.10.2 allows XSS.


vendor: anviz

summary: Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list (which includes RFID codes and passcodes in cleartext), or update/create users. The same attack can be executed on a local network and over the internet (if the device is exposed on a public IP address).


vendor: softing

summary: An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations.


summary: An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter.


summary: An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable.


product: projectsend

vendor: projectsend

summary: Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.


vendor: linksys

summary: Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An attacker can access system OS configurations and commands that are not intended for use beyond the web UI.

title: Linksys Re6400 Firmware security vulnerability


vendor: kalkitech

summary: Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser.

title: Kalkitech Sync3000 Firmware security vulnerability


product: osticket

vendor: enhancesoft

summary: In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.

title: Enhancesoft Osticket security vulnerability


vendor: ivanti

summary: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could allow an authenticated attacker to access the contents of arbitrary files on the affected device.


product: Pulse Connect Secure and Pulse Policy Secure

vulnerability_name: Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability

summary: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.


vendor: pulsesecure

summary: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2 and 5.4RX before 5.4R7.1, an unauthenticated, remote attacker can conduct a session hijacking attack.


summary: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.2RX before 8.2R12.1, users using SAML authentication with the Reuse Existing NC (Pulse) Session option may see authentication leaks.


summary: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.


summary: XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.


product: gitlab

vendor: gitlab

summary: An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It allows Information Disclosure. Non-member users who subscribe to notifications of an internal project with issue and repository restrictions will receive emails about restricted events.

title: Gitlab security vulnerability


summary: An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved to a private project, the private project namespace is leaked to unauthorized users with access to the original issue.


summary: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge.


summary: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.


summary: An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.


summary: An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are included in logs on connection errors.

title: Gitlab security vulnerability


vendor: citrix

product: sd-wan

summary: Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.


summary: In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write.

title: Code42 Code42 For Enterprise security vulnerability


summary: Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.


summary: In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate a user with web restore permission. When requesting the token to do a web restore, an administrator with permission to manage a user could request the token of that user. If the administrator was not authorized to perform web restores but the user was authorized to perform web restores, this would allow the administrator to impersonate the user with greater permissions. In order to exploit this vulnerability, the user would have to be an administrator with access to manage an organization with a user with greater permissions than themselves.

title: Code42 security vulnerability


product: audible

vendor: amazon

summary: The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service.

title: Amazon Audible security vulnerability


product: hostapd

summary: The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.

title: W1.Fi Hostapd security vulnerability


product: pagure

vendor: redhat

vendor: opensuse

summary: Pagure before 5.6 allows XSS via the templates/blame.html blame view.


ecosystem: php/wordpress

vendor: web-dorado

summary: The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

title: Web-Dorado Wp Form Builder security vulnerability


product: hrworks

vendor: hrworks

summary: A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.

title: Hrworks security vulnerability


vendor: hisilicon

summary: A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary code by sending a special RTSP over HTTP packet. The vulnerability was found in many cameras using hisilicon's hardware and software, as demonstrated by TENVIS cameras 1.3.3.3, 1.2.7.2, 1.2.1.4, 7.1.20.1.2, and 13.1.1.1.7.2; FDT FD7902 11.3.14.1.3 and 10.3.14.1.3; FOSCAM cameras 3.2.1.1.1_0815 and 3.2.2.2.1_0815; and Dericam cameras V11.3.8.1.12.

title: Hisilicon Hi3516 Firmware security vulnerability


vendor: chuango

summary: The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When the condition is triggered, the OV2 base station is unable to process sensor states and effectively prevents the alarm from setting off, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.


product: humhub

vendor: humhub

summary: A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.

title: Humhub security vulnerability


archetype: ssrf

summary: Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.


product: aikcms

vendor: aikcms

summary: An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $_GET['del'], as demonstrated by an admin/page/system/nav.php?del= URI.

title: An issue was discovered in AikCms v2.0


summary: An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type.

title: An issue was discovered in AikCms v2.0


vendor: veeam

summary: Veeam ONE Reporter 9.5.0.3201 allows CSRF.


vendor: simplemachines

summary: An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.


product: gitea

vendor: gitea

summary: Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.


product: dhcpcd

summary: dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.


summary: auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.


vendor: debian

summary: dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.


product: Crowd

vendor: Atlassian

less_than: unspecified

business_risk: Critical remote-code-execution risk affecting Atlassian Crowd and Crowd Data Center. The vulnerability permits arbitrary plugin installation and code execution, and CVE-2019-11580 is listed in CISA's Known Exploited Vulnerabilities catalog. Compromise could affect confidentiality, integrity, and availability of the Crowd host and connected identity integrations.

claim: CVE-2019-11580 affects Atlassian Crowd and Crowd Data Center.

claim: Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance may exploit the vulnerability to install arbitrary plugins and achieve remote code execution.

claim: Atlassian identifies 3.0.5, 3.1.6, 3.2.8, 3.3.5, and 3.4.4 as fixed versions for the corresponding release branches.

claim: Atlassian instructs customers running an affected version to upgrade their Crowd or Crowd Data Center installation immediately.

claim: Atlassian states that customers upgraded to 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4 are not affected, supporting inert verification by checking the deployed version against the applicable fixed version.

exposure_conditions: The Crowd or Crowd Data Center instance runs an affected version: 2.1.0 through before 3.0.5; 3.1.0 through before 3.1.6; 3.2.0 through before 3.2.8; 3.3.0 through before 3.3.5; or 3.4.0 through before 3.4.4.

exposure_conditions: An attacker can send requests to the Crowd or Crowd Data Center instance. The advisory describes the request as potentially unauthenticated or authenticated.

remediation_steps: Upgrade Crowd or Crowd Data Center to at least 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4, respectively, according to the installed release branch.

remediation_steps: Prioritize remediation for externally reachable instances and instances integrated with other Atlassian applications or identity directories.

remediation_steps: After upgrading, review relevant authentication, administrative, and application logs for unexpected plugin-installation activity or other indicators of compromise; the available advisory does not define specific log locations or detection patterns.

uncertainty: NVD assigns CWE-ID NVD-CWE-noinfo; a more specific CWE cannot be established from the authoritative sources reviewed.

uncertainty: The sources establish that requests may be unauthenticated or authenticated, but do not establish deployment-specific network exposure, proxy controls, or whether a particular instance is reachable from the Internet.

uncertainty: The sources do not provide a detailed, non-invasive runtime check for whether the pdkinstall development plugin is enabled; version verification is therefore the supported safe validation method.

uncertainty: The advisory provides fixed versions for the listed release branches but does not establish whether later, unsupported, or unlisted product versions are affected.

verification_steps: Confirm the deployed Crowd or Crowd Data Center product and version through the platform's normal administrative or asset-inventory process.

verification_steps: Compare the installed version with the applicable fixed version for its release branch: 3.0.5, 3.1.6, 3.2.8, 3.3.5, or 3.4.4.

verification_steps: Confirm that the upgrade completed successfully and that the running service reports the expected fixed version. Do not use exploit attempts as a validation method.

product: Crowd and Crowd Data Center

vendor_project: Atlassian

vulnerability_name: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

product: crowd

vendor: atlassian

summary: Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.


product: Jira Server and Data Center

business_risk: Critical remote-code-execution risk in Jira Server and Data Center. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog, so affected deployments should be prioritized for immediate remediation.

claim: CVE-2019-11581 affects Atlassian Jira Server and Data Center.

claim: Exploitation requires a configured SMTP server and either an enabled Contact Administrators Form or JIRA Administrators access; the enabled form condition permits unauthenticated exploitation.

claim: Atlassian identifies 7.6.14, 7.13.5, 8.0.3, 8.1.2, and 8.2.3 as fixed releases.

claim: The vendor remediation is to apply the released fixed Jira Server or Jira Data Center versions.

claim: Safe verification can be based on confirming the installed product version is at or above the applicable vendor-fixed release and outside the affected ranges.

exposure_conditions: The vulnerable functionality is in the ContactAdministrators and SendBulkMail actions.

exposure_conditions: Exploitation requires either a configured SMTP server with the Contact Administrators Form enabled, or a configured SMTP server combined with attacker access to the JIRA Administrators group.

exposure_conditions: When the Contact Administrators Form is enabled, exploitation may be unauthenticated; otherwise, JIRA Administrators access is required.

recipe_specificity: specific

remediation_steps: Upgrade Jira Server or Data Center to a vendor-fixed release on the applicable maintenance branch: 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3.

remediation_steps: If the deployment cannot be upgraded immediately, prioritize systems meeting the documented SMTP, Contact Administrators Form, or JIRA Administrators access conditions for isolation and accelerated patching.

remediation_steps: Follow Atlassian's product update guidance and validate the upgrade through the organization's normal change-management process.

uncertainty: The supplied record and authoritative references establish affected ranges, exposure prerequisites, fixed versions, and version-based verification, but do not establish whether a particular deployment has SMTP configured, whether the Contact Administrators Form is enabled, or whether an attacker can reach the instance.

uncertainty: The authoritative sources do not provide a non-invasive runtime check for confirming that the vulnerable actions are no longer exploitable; version comparison is the supported safe verification basis.

uncertainty: The source describes the product as Jira Server and Data Center; applicability to other Atlassian products is not established.

verification_steps: Identify the installed Jira Server or Data Center version using the organization's approved administrative inventory or product-management process.

verification_steps: Confirm that the installed version is at or above the applicable fixed release: 7.6.14, 7.13.5, 8.0.3, 8.1.2, or 8.2.3.

verification_steps: Confirm that the deployed version is not within any affected range: 4.4.0–before 7.6.14, 7.7.0–before 7.13.5, 8.0.0–before 8.0.3, 8.1.0–before 8.1.2, or 8.2.0–before 8.2.3.

verification_steps: Record the installed version and corresponding vendor-fixed branch as evidence of remediation; do not perform exploit testing against production systems.

known_ransomware_campaign_use: Unknown

vulnerability_name: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

author: Codex

description: CVE-2019-11581 is CISA KEV Jira leftover. NVD CPE excludes 7.6.14 / 7.13.5 / 8.0.3 / 8.1.2 / 8.2.3 on jira_server. No Data Center CPE.

maturity: development

title: CVE-2019-11581: Jira Server and Data Center SSTI

recipe_kind: markdown-draft

summary: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.


product: Sourcetree for Windows

product: sourcetree

summary: An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.

title: Atlassian Sourcetree security vulnerability


product: Jira

product: jira

summary: The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".

title: Atlassian Jira security vulnerability


summary: The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.

title: Atlassian Jira security vulnerability


summary: The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

title: Atlassian Jira security vulnerability


summary: The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.

title: Atlassian Jira security vulnerability


summary: Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

title: Atlassian Jira security vulnerability


summary: The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.

title: Atlassian Jira security vulnerability


summary: The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.

title: Atlassian Jira Server security vulnerability


summary: The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

title: 10Web Form Maker security vulnerability


summary: The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.

title: Web-Dorado Contact Form security vulnerability


product: webid

vendor: webidsupport

summary: WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php.

title: Webidsupport Webid security vulnerability


vendor: adblockplus

summary: In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

title: Adblockplus Adblock Plus security vulnerability


product: adblock

vendor: getadblock

summary: In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

title: Getadblock Adblock security vulnerability


vendor: ublockorigin

summary: In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

title: Ublockorigin Ublock Origin security vulnerability


product: memcached

vendor: memcached

vendor: canonical

summary: In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.


product: imagemagick

vendor: imagemagick

summary: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.

title: Imagemagick security vulnerability


summary: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.

title: Imagemagick security vulnerability


vendor: linux

summary: The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.


product: openproject

vendor: openproject

summary: A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.

title: Openproject security vulnerability


vendor: bosch

summary: A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.

title: Bosch Iot Gateway Software security vulnerability


summary: Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.


summary: A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.


vendor: quest

summary: An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page.


product: gitlab

vendor: gitlab

summary: An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Information Disclosure. A small number of GitLab API endpoints would disclose project information when using a read_user scoped token.


vendor: doorgets

summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copyfile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/copydir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/renamefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/movefile.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information or make the server unserviceable.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/downloaddir.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.


summary: doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/contactView.php. A remote normal registered user could exploit the vulnerability to obtain database sensitive information.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php. A remote unauthorized attacker could exploit the vulnerability to obtain database sensitive information.


summary: /fileman/php/upload.php in doorGets 7.0 has an arbitrary file upload vulnerability. A remote normal registered user can use this vulnerability to upload backdoor files to control the server.


summary: doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password.


summary: doorGets 7.0 has a CSRF vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote attacker can exploit this vulnerability for "Google Analytics code" modification.


summary: doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1K9 access_token in a uri=blog&action=index&controller=blog action to /api/index.php.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage configuration analytics) could exploit the vulnerability to obtain database sensitive information.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_add_titre.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network configuration) could exploit the vulnerability to obtain database sensitive information.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_edit_titre.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configuration siteweb) could exploit the vulnerability to obtain database sensitive information.


summary: doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A remote background administrator privilege user can exploit this vulnerability to delete arbitrary files.


summary: doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnerability to obtain database sensitive information.


summary: routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request.

title: Doorgets Doorgets Cms security vulnerability


product: signing-party

product: leap

vendor: opensuse

summary: gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID.


vendor: qlik

summary: An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.

title: Qlik Qlikview Server security vulnerability


vendor: sonatype

summary: Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS.


vendor: octopus

summary: In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a specific project could view or edit unscoped variables from a different project. (These permissions are only used in custom User Roles and do not affect built in User Roles.)

title: Octopus Octopus Deploy security vulnerability


product: honeypress

summary: HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.

title: Honeypress Project Honeypress security vulnerability


business_risk: Critical. Exploitation can allow unauthorized read/write access to client local drives and may enable remote code execution on affected Windows endpoints. CISA lists this CVE in the Known Exploited Vulnerabilities Catalog and identifies known ransomware use.

claim: The affected products are Citrix Workspace app for Windows and Citrix Receiver for Windows LTSR 4.9 CU6.

claim: Citrix Workspace app for Windows prior to version 1904 and Citrix Receiver for Windows LTSR 4.9 CU6 earlier than version 4.9.6001 are affected.

claim: The vulnerability results from local drive access preferences not being enforced, potentially allowing attacker read/write access to client local drives and enabling code execution; the issue does not affect other platforms.

claim: Citrix identifies Workspace app version 1904 or later and Receiver for Windows LTSR 4.9 CU6 version 4.9.6001 as containing the fix.

claim: Citrix recommends upgrading to the fixed versions; it also documents Client Selective Trust as a temporary mitigation when upgrading is not immediately possible, with an operating-system reboot required for the changes to take effect.

claim: A safe remediation check is to confirm the installed product version meets the Citrix-stated fixed-version thresholds: Workspace app 1904 or later, or Receiver LTSR 4.9 CU6 version 4.9.6001 or later.

claim: NVD records the vulnerability as affecting Citrix Workspace for Windows versions before 1904 and lists the Citrix Receiver 4.9 Cumulative Update 6 configuration.

exposure_conditions: Citrix Workspace app for Windows versions before 1904.

exposure_conditions: Citrix Receiver for Windows LTSR 4.9 CU6 versions earlier than 4.9.6001.

exposure_conditions: The issue is limited to Windows; Citrix Workspace app and Receiver on other platforms are not affected.

exposure_conditions: Local drive access preferences are not properly enforced, allowing an attacker to obtain read/write access to client local drives.

remediation_steps: Upgrade Citrix Workspace app for Windows to version 1904 or later.

remediation_steps: Upgrade Citrix Receiver for Windows LTSR 4.9 CU6 to version 4.9.6001 or later.

remediation_steps: If immediate upgrade is not possible, apply Citrix's documented Client Selective Trust policy as a temporary mitigation and reboot the operating system for the policy changes to take effect.

remediation_steps: Prioritize remediation because CISA records active exploitation and known ransomware campaign use.

uncertainty: The supplied source record contains placeholder affected-product data (product and vendor listed as n/a); the product, affected versions, and fixed versions are taken from the authoritative Citrix advisory and NVD records.

uncertainty: The advisory does not provide a universal version-detection command or product-specific inventory path, so verification should use the endpoint's approved software-inventory or application-version mechanism.

uncertainty: The advisory describes the vulnerability as enabling remote code execution but does not provide exploit mechanics; no exploit or active compromise is inferred beyond CISA's KEV classification.

verification_steps: Identify whether the endpoint has Citrix Workspace app for Windows or Receiver for Windows installed.

verification_steps: Confirm the installed Workspace app version is 1904 or later, or confirm the Receiver LTSR 4.9 CU6 version is 4.9.6001 or later.

verification_steps: If the temporary policy mitigation was used, confirm the operating system was rebooted after policy application.

verification_steps: Do not treat restarting only the Citrix application as sufficient for applying the documented policy mitigation.

vendor_project: Citrix

vulnerability_name: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

product: receiver

vendor: citrix

product: workspace

summary: Citrix Workspace App before 1904 for Windows has Incorrect Access Control.


product: zcash

summary: Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "Sapling Wood-Chipper" attack.

title: Z.Cash Zcash security vulnerability


product: recutils

vendor: gnu

summary: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a, leading to a crash.


summary: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash.


summary: An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in librec.a.


summary: An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in librec.a.


product: agave

vendor: anomali

summary: Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size within HTML templates, giving attackers the ability to detect and avoid this system.

title: Anomali Agave security vulnerability


ecosystem: java/maven

vendor: oneshield

summary: A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authenticated remote adversaries can poison log files by entering malicious payloads in either headers or form elements. These payloads are then executed via a client side debugging console. This is predicated on the debugging console and Java Bean being made available to the deployed application.


summary: Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScript into textboxes decorated with type string, which is subsequently stored to the applicable data store. This can be exploited remotely by both authenticated and unauthenticated users.


vendor: f-secure

product: safe

summary: In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker's DLL in an elevated security context.

title: F-Secure Client Security security vulnerability


product: Micro Focus Service Manager

vendor: microfocus

summary: Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61. This vulnerability could allow Remote unauthorized command execution and unauthorized disclosure of information.

title: Microfocus Service Manager security vulnerability


product: Micro Focus NetIQ Self Service Password Reset.

vendor: Micro Focus

version: All versions prior to version 4.4

summary: A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.


vendor: netiq

summary: An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited to expose sensitive information.


summary: Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Software Security Center. The vulnerability could be exploited to execute JavaScript code in user’s browser. The vulnerability could be exploited to execute JavaScript code in user’s browser.

title: Microfocus Fortify Software Security Center security vulnerability


product: NetIQ Advanced Authentication Framework

version: Versions prior to 6.0

summary: A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0.


version: All versions prior to version 3.0 Patch Update 20. version 4.0 Patch Update 12 and version 5.0 Patc…

summary: Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests.

title: Microfocus Enterprise Developer security vulnerability


product: Self Service Password Reset (SSPR)

version: prior to 4.4.0.3

version: prior to 4.3.0.6

version: prior to 4.2.0.6

summary: A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to Micro Focus Self Service Password Reset (SSPR) SSPR versions 4.4.0.3, 4.3.0.6, or 4.2.0.6 as appropriate.

title: Microfocus Netiq Self Service Password Reset security vulnerability


product: Content Manager

summary: Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during another user’s CheckIn request.


product: Verastream Host Integrator

summary: Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.

title: Microfocus Verastream Host Integrator security vulnerability


product: ArcSight Logger.

version: 6.7.0 and later.

vendor: hp

summary: Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.


version: All versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0.

summary: Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').


product: ArcSight Logger

vendor: Micro Focus International

version: All ArcSight Logger prior to version 7.0

summary: Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploited to perform CSRF attack.


summary: Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state.


product: Data Protector

summary: Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.


product: Service Manager

summary: Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized access and modification of data.


summary: Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited in some special cases to allow information exposure through an error message.


summary: Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.


summary: Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.


summary: Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow sensitive data exposure.


summary: Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data.


summary: Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to private data.


product: Service Manager, Service Manager – Chat Service. Server Manager – Chat Service.

summary: HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Server, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. And Micro Focus Service Manager Chat Service 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.


summary: Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized modification of data.


product: Self Service Password Reset (SSPR) versions prior to 4.4.0.4

version: All versions prior to 4.4.0.4.

summary: Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.


product: groonga-httpd

vendor: groonga

summary: The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash_completion.d. NOTE: this is an issue in the Debian packaging of the Groonga HTTP server.

title: Groonga Groonga-Httpd security vulnerability


vendor: zohocorp

summary: The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.


summary: The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection.

title: Zohocorp Manageengine Firewall Analyzer security vulnerability


summary: The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.


product: konakart

vendor: konakart

summary: KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image.


product: mailcarrier

vendor: tabslab

summary: A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP command, a related issue to CVE-2019-11395.

title: Tabslab Mailcarrier security vulnerability


vendor: linux

vendor: canonical

summary: udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue.

title: Linux Linux Kernel security vulnerability


vendor: bosch

summary: Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.

title: Bosch Video Recording Manager security vulnerability


vendor: westerndigital

summary: Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive parameters (such as data encryption keys) to remain on the drive media after their intended erasure.

title: Westerndigital Sandisk X600 Sd9Tb8W-128G Firmware security vulnerability


vendor: nema

summary: An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte preamble of a DICOM file that complies with this specification can contain arbitrary executable headers for multiple operating systems, including Portable Executable (PE) files for Windows and Executable and Linkable Format (ELF) files for Linux-based systems. This space is left unspecified so that dual-purpose files can be created. For example, dual-purpose TIFF/DICOM files are used in digital whole slide imaging applications in medicine. This design flaw enables system-wide compromise as malicious DICOM files are routinely shared between medical devices and hospital systems and transported via removable media for patient care coordination. To exploit this vulnerability, someone must execute the maliciously crafted file. These files can be executable even with the .dcm file extension. Anti-malware configurations at healthcare facilities often ignore medical imagery.

title: Nema Dicom Standard security vulnerability


vendor: asustor

summary: An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asustornasapi.asustor.com. In other words, there is Missing SSL Certificate Validation.


summary: An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.


product: u-boot

vendor: denx

summary: gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.

title: Denx U-Boot security vulnerability


product: Thunderbird

vendor: Mozilla

product: Firefox

product: Firefox ESR

ecosystem: browser

product: firefox

vendor: mozilla

product: thunderbird

summary: A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

title: Mozilla Firefox security vulnerability


summary: A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

title: Mozilla Firefox security vulnerability


summary: The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


summary: A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

title: Mozilla Firefox security vulnerability


summary: A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. This vulnerability affects Firefox < 67.

title: Mozilla Firefox security vulnerability


summary: Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. This vulnerability affects Firefox < 67.

title: Mozilla Firefox security vulnerability