From 4a1638bd3dd3c6196427b91ba66a808053338008 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Mon, 9 Sep 2019 21:00:50 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2018/19xxx/CVE-2018-19856.json | 8 ++-- 2018/21xxx/CVE-2018-21012.json | 5 +++ 2019/10xxx/CVE-2019-10253.json | 61 ++++++++++++++++++++++++++++--- 2019/15xxx/CVE-2019-15297.json | 67 ++++++++++++++++++++++++++++++++++ 2019/15xxx/CVE-2019-15895.json | 7 +++- 2019/16xxx/CVE-2019-16145.json | 62 +++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16147.json | 62 +++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16174.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16175.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16176.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16177.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16178.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16179.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16180.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16181.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16182.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16183.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16184.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16185.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16186.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16187.json | 67 ++++++++++++++++++++++++++++++++++ 2019/16xxx/CVE-2019-16192.json | 62 +++++++++++++++++++++++++++++++ 2019/6xxx/CVE-2019-6791.json | 48 +++++++++++++++++++++++- 2019/7xxx/CVE-2019-7176.json | 53 ++++++++++++++++++++++++++- 2019/7xxx/CVE-2019-7549.json | 14 +++---- 25 files changed, 1365 insertions(+), 22 deletions(-) create mode 100644 2019/15xxx/CVE-2019-15297.json create mode 100644 2019/16xxx/CVE-2019-16145.json create mode 100644 2019/16xxx/CVE-2019-16147.json create mode 100644 2019/16xxx/CVE-2019-16174.json create mode 100644 2019/16xxx/CVE-2019-16175.json create mode 100644 2019/16xxx/CVE-2019-16176.json create mode 100644 2019/16xxx/CVE-2019-16177.json create mode 100644 2019/16xxx/CVE-2019-16178.json create mode 100644 2019/16xxx/CVE-2019-16179.json create mode 100644 2019/16xxx/CVE-2019-16180.json create mode 100644 2019/16xxx/CVE-2019-16181.json create mode 100644 2019/16xxx/CVE-2019-16182.json create mode 100644 2019/16xxx/CVE-2019-16183.json create mode 100644 2019/16xxx/CVE-2019-16184.json create mode 100644 2019/16xxx/CVE-2019-16185.json create mode 100644 2019/16xxx/CVE-2019-16186.json create mode 100644 2019/16xxx/CVE-2019-16187.json create mode 100644 2019/16xxx/CVE-2019-16192.json diff --git a/2018/19xxx/CVE-2018-19856.json b/2018/19xxx/CVE-2018-19856.json index 1db12ddf46a..deeb1d0ec3c 100644 --- a/2018/19xxx/CVE-2018-19856.json +++ b/2018/19xxx/CVE-2018-19856.json @@ -53,12 +53,12 @@ "references": { "reference_data": [ { - "url": "https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/", - "refsource": "MISC", - "name": "https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/" + "refsource": "CONFIRM", + "name": "https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/", + "url": "https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/" }, { - "refsource": "MISC", + "refsource": "CONFIRM", "name": "https://gitlab.com/gitlab-org/gitlab-ce/issues/54857", "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/54857" } diff --git a/2018/21xxx/CVE-2018-21012.json b/2018/21xxx/CVE-2018-21012.json index bd805c89e9a..3a0a941329d 100644 --- a/2018/21xxx/CVE-2018-21012.json +++ b/2018/21xxx/CVE-2018-21012.json @@ -56,6 +56,11 @@ "url": "https://wordpress.org/plugins/cf7-invisible-recaptcha/#developers", "refsource": "MISC", "name": "https://wordpress.org/plugins/cf7-invisible-recaptcha/#developers" + }, + { + "refsource": "MISC", + "name": "https://www.pluginvulnerabilities.com/2018/05/17/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha/", + "url": "https://www.pluginvulnerabilities.com/2018/05/17/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha/" } ] } diff --git a/2019/10xxx/CVE-2019-10253.json b/2019/10xxx/CVE-2019-10253.json index 96612bd3224..7e31f75cd8e 100644 --- a/2019/10xxx/CVE-2019-10253.json +++ b/2019/10xxx/CVE-2019-10253.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2019-10253", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2019-10253", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "http://www.teammatesolutions.com/", + "refsource": "MISC", + "name": "http://www.teammatesolutions.com/" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html", + "url": "http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html" } ] } diff --git a/2019/15xxx/CVE-2019-15297.json b/2019/15xxx/CVE-2019-15297.json new file mode 100644 index 00000000000..baf61fa815c --- /dev/null +++ b/2019/15xxx/CVE-2019-15297.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-15297", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/154371/Asterisk-Project-Security-Advisory-AST-2019-004.html", + "url": "http://packetstormsecurity.com/files/154371/Asterisk-Project-Security-Advisory-AST-2019-004.html" + }, + { + "refsource": "CONFIRM", + "name": "http://downloads.asterisk.org/pub/security/AST-2019-004.html", + "url": "http://downloads.asterisk.org/pub/security/AST-2019-004.html" + } + ] + } +} \ No newline at end of file diff --git a/2019/15xxx/CVE-2019-15895.json b/2019/15xxx/CVE-2019-15895.json index 223b25a0542..8db1ec22497 100644 --- a/2019/15xxx/CVE-2019-15895.json +++ b/2019/15xxx/CVE-2019-15895.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "search-exclude.php in the \"Search Exclude\" plugin through 1.2.2 for WordPress allows unauthenticated options changes." + "value": "search-exclude.php in the \"Search Exclude\" plugin before 1.2.4 for WordPress allows unauthenticated options changes." } ] }, @@ -61,6 +61,11 @@ "refsource": "MISC", "name": "https://wpvulndb.com/vulnerabilities/9870", "url": "https://wpvulndb.com/vulnerabilities/9870" + }, + { + "refsource": "MISC", + "name": "https://blog.nintechnet.com/settings-change-vulnerability-in-wordpress-search-exclude-plugin/", + "url": "https://blog.nintechnet.com/settings-change-vulnerability-in-wordpress-search-exclude-plugin/" } ] } diff --git a/2019/16xxx/CVE-2019-16145.json b/2019/16xxx/CVE-2019-16145.json new file mode 100644 index 00000000000..5f8a0d1e719 --- /dev/null +++ b/2019/16xxx/CVE-2019-16145.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16145", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/padrino/padrino-contrib/pull/35", + "refsource": "MISC", + "name": "https://github.com/padrino/padrino-contrib/pull/35" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16147.json b/2019/16xxx/CVE-2019-16147.json new file mode 100644 index 00000000000..a6e76060687 --- /dev/null +++ b/2019/16xxx/CVE-2019-16147.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16147", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f", + "refsource": "MISC", + "name": "https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16174.json b/2019/16xxx/CVE-2019-16174.json new file mode 100644 index 00000000000..02408b72371 --- /dev/null +++ b/2019/16xxx/CVE-2019-16174.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16174", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16175.json b/2019/16xxx/CVE-2019-16175.json new file mode 100644 index 00000000000..e32ad03b1e0 --- /dev/null +++ b/2019/16xxx/CVE-2019-16175.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16175", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A clickjacking vulnerability was found in Limesurvey before 3.17.14." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R41", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R41" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16176.json b/2019/16xxx/CVE-2019-16176.json new file mode 100644 index 00000000000..ac4ad2b9095 --- /dev/null +++ b/2019/16xxx/CVE-2019-16176.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16176", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R43", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R43" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16177.json b/2019/16xxx/CVE-2019-16177.json new file mode 100644 index 00000000000..62ad4774bce --- /dev/null +++ b/2019/16xxx/CVE-2019-16177.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16177", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In Limesurvey before 3.17.14, the entire database is exposed through browser caching." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R53", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R53" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16178.json b/2019/16xxx/CVE-2019-16178.json new file mode 100644 index 00000000000..46ba35ff162 --- /dev/null +++ b/2019/16xxx/CVE-2019-16178.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16178", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R39", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R39" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16179.json b/2019/16xxx/CVE-2019-16179.json new file mode 100644 index 00000000000..4de59ffea73 --- /dev/null +++ b/2019/16xxx/CVE-2019-16179.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16179", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R42", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R42" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16180.json b/2019/16xxx/CVE-2019-16180.json new file mode 100644 index 00000000000..1bf7da3d177 --- /dev/null +++ b/2019/16xxx/CVE-2019-16180.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16180", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R44", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R44" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16181.json b/2019/16xxx/CVE-2019-16181.json new file mode 100644 index 00000000000..0c7a3f6e787 --- /dev/null +++ b/2019/16xxx/CVE-2019-16181.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16181", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In Limesurvey before 3.17.14, admin users can mark other users' notifications as read." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R52", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R52" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16182.json b/2019/16xxx/CVE-2019-16182.json new file mode 100644 index 00000000000..e41d279932a --- /dev/null +++ b/2019/16xxx/CVE-2019-16182.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16182", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R57", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R57" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16183.json b/2019/16xxx/CVE-2019-16183.json new file mode 100644 index 00000000000..755a7aab2b3 --- /dev/null +++ b/2019/16xxx/CVE-2019-16183.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16183", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R50", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R50" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16184.json b/2019/16xxx/CVE-2019-16184.json new file mode 100644 index 00000000000..0aa5167c3b0 --- /dev/null +++ b/2019/16xxx/CVE-2019-16184.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16184", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16185.json b/2019/16xxx/CVE-2019-16185.json new file mode 100644 index 00000000000..517d8d1f0bb --- /dev/null +++ b/2019/16xxx/CVE-2019-16185.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16185", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R51", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R51" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16186.json b/2019/16xxx/CVE-2019-16186.json new file mode 100644 index 00000000000..f5ad0de31fb --- /dev/null +++ b/2019/16xxx/CVE-2019-16186.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16186", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R49", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R49" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16187.json b/2019/16xxx/CVE-2019-16187.json new file mode 100644 index 00000000000..c7e11d4a680 --- /dev/null +++ b/2019/16xxx/CVE-2019-16187.json @@ -0,0 +1,67 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16187", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released", + "refsource": "MISC", + "name": "https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released" + }, + { + "url": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R48", + "refsource": "MISC", + "name": "https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R48" + } + ] + } +} \ No newline at end of file diff --git a/2019/16xxx/CVE-2019-16192.json b/2019/16xxx/CVE-2019-16192.json new file mode 100644 index 00000000000..807d877f612 --- /dev/null +++ b/2019/16xxx/CVE-2019-16192.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-16192", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/SuperSalsa20/Doccms-Execute-Code/blob/master/README.md", + "refsource": "MISC", + "name": "https://github.com/SuperSalsa20/Doccms-Execute-Code/blob/master/README.md" + } + ] + } +} \ No newline at end of file diff --git a/2019/6xxx/CVE-2019-6791.json b/2019/6xxx/CVE-2019-6791.json index fa77e672cc6..46a96fafdae 100644 --- a/2019/6xxx/CVE-2019-6791.json +++ b/2019/6xxx/CVE-2019-6791.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-6791", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,28 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/", + "url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/" } ] } diff --git a/2019/7xxx/CVE-2019-7176.json b/2019/7xxx/CVE-2019-7176.json index bc525bd613e..3c36bbb48bb 100644 --- a/2019/7xxx/CVE-2019-7176.json +++ b/2019/7xxx/CVE-2019-7176.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-7176", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/", + "url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/" + }, + { + "refsource": "CONFIRM", + "name": "https://gitlab.com/gitlab-org/gitlab-ce/issues/51332", + "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/51332" } ] } diff --git a/2019/7xxx/CVE-2019-7549.json b/2019/7xxx/CVE-2019-7549.json index 784d10f9a75..01450f834ee 100644 --- a/2019/7xxx/CVE-2019-7549.json +++ b/2019/7xxx/CVE-2019-7549.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control," + "value": "An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.7.3. It has Incorrect Access Control. The GitLab pipelines feature is vulnerable to authorization issues that allow unauthorized users to view job information." } ] }, @@ -53,14 +53,14 @@ "references": { "reference_data": [ { - "url": "https://about.gitlab.com/blog/categories/releases/", - "refsource": "MISC", - "name": "https://about.gitlab.com/blog/categories/releases/" + "refsource": "CONFIRM", + "name": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/", + "url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/" }, { - "url": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/", - "refsource": "MISC", - "name": "https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/" + "refsource": "CONFIRM", + "name": "https://gitlab.com/gitlab-org/gitlab-ce/issues/54358", + "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/54358" } ] }