cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/a:juniper:junos:18.2 cpe:/a:juniper:junos:18.2:r1-s3 cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r6-s6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1

CVE-2019-0001

2019-01-15T16:29:00.760-05:00

2019-10-09T19:43:27.757-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 106541 CONFIRM https://kb.juniper.net/JSA10900 Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/a:juniper:junos:18.2 cpe:/a:juniper:junos:18.2:r1 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59

CVE-2019-0002

2019-01-15T16:29:00.823-05:00

2019-10-09T19:43:27.960-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106669 CONFIRM https://kb.juniper.net/JSA10901 MISC https://www.juniper.net/documentation/en_US/junos/topics/reference/command-summary/show-pfe-filter.html On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2. This issue affect both IPv4 and IPv6 firewall filter.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r7-s2 cpe:/o:juniper:junos:15.1:r7-s3 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d56

CVE-2019-0003

2019-01-15T16:29:00.887-05:00

2019-10-09T19:43:28.163-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 106544 CONFIRM https://kb.juniper.net/JSA10902 When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.

CVE-2019-0004

2019-01-15T16:29:00.917-05:00

2019-10-09T19:43:28.553-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d234 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d590 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r6-s6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1

CVE-2019-0005

2019-01-15T16:29:00.963-05:00

2019-02-14T13:40:12.217-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-18T11:57:06.997-05:00

BID 106665 CONFIRM https://kb.juniper.net/JSA10905 On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:r1 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d50

CVE-2019-0006

2019-01-15T16:29:01.027-05:00

2019-10-09T19:43:28.727-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106666 CONFIRM https://kb.juniper.net/JSA10906 A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.

cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5

CVE-2019-0007

2019-01-15T16:29:01.087-05:00

2019-10-09T19:43:29.007-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106564 CONFIRM https://kb.juniper.net/JSA10903 The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d31 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r1-s8 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.2:r2-s7 cpe:/o:juniper:junos:17.2:r3-s1 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.3:r3-s3 cpe:/o:juniper:junos:17.3:r3-s4 cpe:/o:juniper:junos:17.3r3 cpe:/o:juniper:junos:17.3r4 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:17.4r3 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r2-s4 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.1:r3-s3 cpe:/o:juniper:junos:18.1:r3-s4 cpe:/o:juniper:junos:18.1r4 cpe:/o:juniper:junos:18.2 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1-s5 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2:r2-s2 cpe:/o:juniper:junos:18.2:r2-s3 cpe:/o:juniper:junos:18.2:r2-s4 cpe:/o:juniper:junos:18.2:r3 cpe:/o:juniper:junos:18.2x75 cpe:/o:juniper:junos:18.2x75:d20 cpe:/o:juniper:junos:18.2x75:d40 cpe:/o:juniper:junos:18.3 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.3:r1-s3 cpe:/o:juniper:junos:18.3:r2

CVE-2019-0008

2019-04-10T16:29:00.380-04:00

2019-04-15T08:31:26.197-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107897 CONFIRM https://kb.juniper.net/JSA10930 A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/a:juniper:junos:18.2:r1 cpe:/a:juniper:junos:18.2:r1-s3 cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:18.2

CVE-2019-0009

2019-01-15T16:29:01.137-05:00

2019-10-09T19:43:29.273-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106548 CONFIRM https://kb.juniper.net/JSA10909 On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This issue does not affect other Junos platforms. Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R2-S2, 18.1R3; 18.2 versions prior to 18.2R2.

CVE-2019-0010

2019-01-15T16:29:01.197-05:00

2019-10-09T19:43:29.443-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106535 CONFIRM https://kb.juniper.net/JSA10910 An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packet inspected by UTM consumes mbufs which can be identified through the following log messages: all_logs.0:Jun 8 03:25:03 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 50%. all_logs.0:Jun 8 03:25:13 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 51%. all_logs.0:Jun 8 03:25:24 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 52%. ... Eventually the system runs out of mbufs and the system crashes (fails over) with the error "mbuf exceed". This issue only occurs when HTTP AV inspection is configured. Devices configured for Web Filtering alone are unaffected by this issue. Affected releases are Junos OS on SRX Series: 12.1X46 versions prior to 12.1X46-D81; 12.3X48 versions prior to 12.3X48-D77; 15.1X49 versions prior to 15.1X49-D101, 15.1X49-D110.

cpe:/a:juniper:junos:18.1:- cpe:/a:juniper:junos:18.1:r1 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s3 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s5 cpe:/o:juniper:junos:17.2:r1-s6 cpe:/o:juniper:junos:17.2x75:- cpe:/o:juniper:junos:17.2x75:d100 cpe:/o:juniper:junos:17.2x75:d102 cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.2x75:d70 cpe:/o:juniper:junos:17.2x75:d90 cpe:/o:juniper:junos:17.2x75:d92 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s3

CVE-2019-0011

2019-01-15T16:29:01.230-05:00

2019-10-09T19:43:29.677-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106534 CONFIRM https://kb.juniper.net/JSA10911 The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 17.2X75 versions prior to 17.2X75-D110; 18.1 versions prior to 18.1R2.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.1x46:d66 cpe:/o:juniper:junos:12.1x46:d67 cpe:/o:juniper:junos:12.1x46:d71 cpe:/o:juniper:junos:12.1x46:d72 cpe:/o:juniper:junos:12.1x46:d76 cpe:/o:juniper:junos:12.1x46:d77 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:12.3x48:d75 cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d121 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d590 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:15.1x53:d68 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s2

CVE-2019-0012

2019-01-15T16:29:01.277-05:00

2019-10-09T19:43:29.850-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 106536 CONFIRM https://kb.juniper.net/JSA10912 A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. This issue only affects PE routers configured with BGP Auto discovery for LDP VPLS. Other BGP configurations are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81; 12.3 versions prior to 12.3R12-S12; 12.3X48 versions prior to 12.3X48-D76; 14.1X53 versions prior to 14.1X53-D48; 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D235, 15.1X53-D495, 15.1X53-D590, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.1x46:d66 cpe:/o:juniper:junos:12.1x46:d67 cpe:/o:juniper:junos:12.1x46:d71 cpe:/o:juniper:junos:12.1x46:d76 cpe:/o:juniper:junos:12.3x48 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d51 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d66 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:12.3x48:d75 cpe:/o:juniper:junos:15.1 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2-s2

CVE-2019-0013

2019-01-15T16:29:01.337-05:00

2019-10-09T19:43:30.193-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106519 CONFIRM https://kb.juniper.net/JSA10913 The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects IPv4 PIM. IPv6 PIM is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D77; 15.1 versions prior to 15.1F6-S10, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R7; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R2-S3, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/o:juniper:junos:17.2x75:d102 cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.2x75:d70 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.2:r1

CVE-2019-0014

2019-01-15T16:29:01.387-05:00

2019-10-09T19:43:30.507-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106556 CONFIRM https://kb.juniper.net/JSA10914 On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.

cpe:/a:juniper:junos:18.1 cpe:/a:juniper:junos:18.1:r1 cpe:/a:juniper:junos:18.1:r2 cpe:/a:juniper:junos:18.2:r1-s3 cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:18.2 cpe:/o:juniper:junos:18.2:r1

CVE-2019-0015

2019-01-15T16:29:01.417-05:00

2019-10-09T19:43:30.677-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 106668 CONFIRM https://kb.juniper.net/JSA10915 A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

cpe:/a:juniper:junos_space:13.3:r1 cpe:/a:juniper:junos_space:13.3:r2 cpe:/a:juniper:junos_space:13.3:r3 cpe:/a:juniper:junos_space:13.3:r4 cpe:/a:juniper:junos_space:14.1:- cpe:/a:juniper:junos_space:14.1:r1 cpe:/a:juniper:junos_space:14.1:r2 cpe:/a:juniper:junos_space:14.1:r3 cpe:/a:juniper:junos_space:15.1:r1 cpe:/a:juniper:junos_space:15.1:r2 cpe:/a:juniper:junos_space:15.1:r3 cpe:/a:juniper:junos_space:15.1:r4 cpe:/a:juniper:junos_space:15.2:- cpe:/a:juniper:junos_space:15.2:r1 cpe:/a:juniper:junos_space:15.2:r2 cpe:/a:juniper:junos_space:16.1:- cpe:/a:juniper:junos_space:16.1:r1 cpe:/a:juniper:junos_space:16.1:r2 cpe:/a:juniper:junos_space:16.1:r3 cpe:/a:juniper:junos_space:17.1:r1 cpe:/a:juniper:junos_space:17.2:r1.4 cpe:/a:juniper:junos_space:18.1:r1 cpe:/a:juniper:junos_space:18.2:r1

CVE-2019-0016

2019-01-15T16:29:01.463-05:00

2019-10-09T19:43:30.990-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10917 A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

CVE-2019-0017

2019-01-15T16:29:01.493-05:00

2019-10-09T19:43:31.147-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10917 The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.

CVE-2019-0018

2019-01-15T16:29:01.557-05:00

2019-10-09T19:43:31.320-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.2x75:- cpe:/o:juniper:junos:18.2x75:d20 cpe:/o:juniper:junos:18.2x75:d5 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.4:- cpe:/o:juniper:junos:18.4:r1

CVE-2019-0019

2019-04-10T16:29:00.413-04:00

2019-10-09T19:43:31.460-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107893 CONFIRM https://kb.juniper.net/JSA10931 When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9, 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3, 17.3R3-S4, 17.3R4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4, 18.1R4; 18.2 versions prior to 18.2R2-S2, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. This issue does not affect Junos releases prior to 16.1R1.

CVE-2019-0020

2019-01-15T16:29:01.587-05:00

2019-10-09T19:43:31.693-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.

CVE-2019-0021

2019-01-15T16:29:01.637-05:00

2019-10-09T19:43:31.880-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

CVE-2019-0022

2019-01-15T16:29:01.683-05:00

2019-10-09T19:43:32.053-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.

CVE-2019-0023

2019-01-15T16:29:01.730-05:00

2019-10-09T19:43:32.240-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

CVE-2019-0024

2019-01-15T16:29:01.790-05:00

2019-10-09T19:43:32.380-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

CVE-2019-0025

2019-01-15T16:29:01.837-05:00

2019-10-09T19:43:32.523-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

CVE-2019-0026

2019-01-15T16:29:01.887-05:00

2019-10-09T19:43:32.663-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

CVE-2019-0027

2019-01-15T16:29:01.917-05:00

2019-10-09T19:43:32.803-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

cpe:/a:juniper:junos:18.1:- cpe:/a:juniper:junos:18.1:r1 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.1x65:- cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s1 cpe:/o:juniper:junos:16.2:r2-s2 cpe:/o:juniper:junos:16.2:r2-s3 cpe:/o:juniper:junos:16.2:r2-s4 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r2-s6 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:16.2:r2-s8 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1r3 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s3 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s5 cpe:/o:juniper:junos:17.2:r1-s6 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2r3 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:d102 cpe:/o:juniper:junos:17.2x75:d110 cpe:/o:juniper:junos:17.2x75:d92 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3r3 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s3 cpe:/o:juniper:junos:17.4r2

CVE-2019-0028

2019-04-10T16:29:00.460-04:00

2019-10-09T19:43:32.943-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107892 CONFIRM https://kb.juniper.net/JSA10932 On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. By simulating a specific BGP session restart, an attacker can repeatedly crash the RPD process causing prolonged denial of service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R2. Junos OS releases prior to 16.1R1 are not affected.

CVE-2019-0029

2019-01-15T16:29:01.980-05:00

2019-10-09T19:43:33.147-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

CVE-2019-0030

2019-01-15T16:29:02.027-05:00

2019-10-09T19:43:33.303-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10918 Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r2-s4 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.1:r3-s3 cpe:/o:juniper:junos:18.1:r3-s4

CVE-2019-0031

2019-04-10T16:29:00.490-04:00

2019-04-12T04:29:00.297-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107874 CONFIRM https://kb.juniper.net/JSA10920 Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the jdhcpd daemon, thus creating a Denial of Service (DoS) condition to clients requesting and not receiving IP addresses. Additionally, some clients which were previously holding IPv6 addresses will not have their IPv6 Identity Association (IA) address and network tables agreed upon by the jdhcpd daemon after the failover event occurs, which leads to more than one interface, and multiple IP addresses, being denied on the client. Affected releases are Juniper Networks Junos OS: 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.

CVE-2019-0032

2019-04-10T16:29:00.537-04:00

2019-04-12T09:29:01.673-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107885 CONFIRM https://kb.juniper.net/JSA10921 MISC https://kb.juniper.net/KB27572 A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper Networks Service Insight versions from 15.1R1, prior to 18.1R1. Service Now versions from 15.1R1, prior to 18.1R1.

cpe:/o:juniper:junos:12.1x46 cpe:/o:juniper:junos:12.1x46:- cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d73 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d80 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80

CVE-2019-0033

2019-04-10T16:29:00.583-04:00

2019-04-12T12:29:00.247-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107882 CONFIRM https://kb.juniper.net/JSA10922 A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS). This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D25 prior to 12.1X46-D71, 12.1X46-D73 on SRX Series; 12.3X48 versions prior to 12.3X48-D50 on SRX Series; 15.1X49 versions prior to 15.1X49-D75 on SRX Series.

CVE-2019-0034

2019-04-10T16:29:00.630-04:00

2019-04-15T08:31:28.617-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a vulnerability. Notes: Google gRPC credentials were found which existed for specific internal product testing purposes which are not used as part of production releases of Junos OS. Hence this is not a vulnerability and this CVE ID assignment has been withdrawn.

cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2x75 cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1

CVE-2019-0035

2019-04-10T16:29:00.710-04:00

2019-10-09T19:43:33.837-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10924 When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM (Operations, Administration, and Maintenance) volume, leading to a possible administrative bypass with physical access to the console. OAM volumes (e.g. flash drives) are typically instantiated as /dev/gpt/oam, or /oam for short. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.

cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:14.1x53:- cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:14.1x53:d48 cpe:/o:juniper:junos:15.1:- cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1f6-s1:f6 cpe:/o:juniper:junos:15.1f6-s2:f6 cpe:/o:juniper:junos:15.1f6-s4:f6 cpe:/o:juniper:junos:15.1f6-s5:f6 cpe:/o:juniper:junos:15.1f6-s6:f6 cpe:/o:juniper:junos:15.1f6-s7:f6 cpe:/o:juniper:junos:15.1f6-s8:f6 cpe:/o:juniper:junos:15.1f6-s9:f6 cpe:/o:juniper:junos:15.1f6-s10:f6 cpe:/o:juniper:junos:15.1f6-s11:f6 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r3:- cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.3:r3-s3 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.2:r1:- cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2:r2-s2 cpe:/o:juniper:junos:18.2x75:- cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.4:r1

CVE-2019-0036

2019-04-10T16:29:00.757-04:00

2019-10-09T19:43:34.177-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10925 When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1", "internal-2", etc.) are silently ignored. No warning is issued during configuration, and the config is committed without error, but the filter criteria will match all packets leading to unexpected results. Affected releases are Juniper Networks Junos OS: All versions prior to and including 12.3; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D161, 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S1; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3; 18.4 versions prior to 18.4R1-S1, 18.4R1-S2.

cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1:r7 cpe:/o:juniper:junos:15.1x49-d30 cpe:/o:juniper:junos:15.1x49-d60 cpe:/o:juniper:junos:15.1x49-d140 cpe:/o:juniper:junos:15.1x49-d150 cpe:/o:juniper:junos:15.1x49-d160 cpe:/o:juniper:junos:15.1x53-d50 cpe:/o:juniper:junos:15.1x53-d51 cpe:/o:juniper:junos:15.1x53-d52 cpe:/o:juniper:junos:15.1x53-d55 cpe:/o:juniper:junos:15.1x53-d57 cpe:/o:juniper:junos:15.1x53-d58 cpe:/o:juniper:junos:15.1x53-d59 cpe:/o:juniper:junos:16:r2 cpe:/o:juniper:junos:16:r3 cpe:/o:juniper:junos:16:r4 cpe:/o:juniper:junos:16:r5 cpe:/o:juniper:junos:16:r6 cpe:/o:juniper:junos:16:r7 cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r2-s9 cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r3 cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s5 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s1 cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2x75-d10 cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1

CVE-2019-0037

2019-04-10T16:29:00.787-04:00

2019-10-09T19:43:34.490-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107894 CONFIRM https://kb.juniper.net/JSA10926 In a Dynamic Host Configuration Protocol version 6 (DHCPv6) environment, the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client. By continuously sending the same crafted packet, an attacker can repeatedly crash the jdhcpd process causing a sustained Denial of Service (DoS) to both IPv4 and IPv6 clients. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496; 16.1 versions prior to 16.1R3-S10, 16.1R7-S4; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.

cpe:/o:juniper:junos:15.1x49:- cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s2 cpe:/o:juniper:junos:18:1:r2-s1 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r2

CVE-2019-0038

2019-04-10T16:29:00.820-04:00

2019-10-09T19:43:34.740-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 107873 CONFIRM https://kb.juniper.net/JSA10927 Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345; 17.3 on SRX340/SRX345; 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345; 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345; 18.2 versions prior to 18.2R2 on SRX340/SRX345; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345. This issue does not affect Junos OS releases prior to 15.1X49 on any platform.

cpe:/o:juniper:junos:14.1x53 cpe:/o:juniper:junos:14.1x53:- cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d48 cpe:/o:juniper:junos:14.1x53:r1 cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f6-s3 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r4-s9 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7-s1 cpe:/o:juniper:junos:15.1:r7-s2 cpe:/o:juniper:junos:15.1:r7-s3 cpe:/o:juniper:junos:15.1r7-s3 cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d31 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d470 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:15.1x53-d69 cpe:/o:juniper:junos:15.1x53-d495 cpe:/o:juniper:junos:15.1x53-d591 cpe:/o:juniper:junos:16.1 cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5-s4 cpe:/o:juniper:junos:16.1:r6-s1 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.1:r7-s4 cpe:/o:juniper:junos:16.1:r7-s5 cpe:/o:juniper:junos:16.1r4-s12 cpe:/o:juniper:junos:16.1r6-s6 cpe:/o:juniper:junos:16.1r7-s3 cpe:/o:juniper:junos:16.1x65 cpe:/o:juniper:junos:16.1x65:d48 cpe:/o:juniper:junos:16.2 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s1 cpe:/o:juniper:junos:16.2:r2-s2 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r2-s6 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:16.2:r2-s8 cpe:/o:juniper:junos:16.2:r3 cpe:/o:juniper:junos:17.1 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.1r3 cpe:/o:juniper:junos:17.2 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r1-s8 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.2:r2-s7 cpe:/o:juniper:junos:17.2:r3-s1 cpe:/o:juniper:junos:17.2r3-s1 cpe:/o:juniper:junos:17.3 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.3:r3-s3 cpe:/o:juniper:junos:17.3:r3-s4 cpe:/o:juniper:junos:17.3r3 cpe:/o:juniper:junos:17.4 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:17.4r2-s2 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r2-s4 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.1:r3-s3 cpe:/o:juniper:junos:18.1:r3-s4 cpe:/o:juniper:junos:18.1r3-s1 cpe:/o:juniper:junos:18.2 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1-s5 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2:r2-s2 cpe:/o:juniper:junos:18.2:r2-s3 cpe:/o:juniper:junos:18.2:r2-s4 cpe:/o:juniper:junos:18.2:r3 cpe:/o:juniper:junos:18.2x75 cpe:/o:juniper:junos:18.2x75:d20 cpe:/o:juniper:junos:18.2x75:d40 cpe:/o:juniper:junos:18.3 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.3:r1-s3 cpe:/o:juniper:junos:18.3:r2

CVE-2019-0039

2019-04-10T16:29:00.850-04:00

2019-04-15T08:31:28.977-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107899 CONFIRM https://kb.juniper.net/JSA10928 If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators who do not enforce a strong password policy can increase the likelihood of success from brute force attacks. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D495, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.2 versions prior to 18.2R1-S5; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S1.

cpe:/o:juniper:junos:15.1:- cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1x53:- cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:15.1x53:d68 cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:16.2:r2-s8 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1

CVE-2019-0040

2019-04-10T16:29:00.897-04:00

2019-10-09T19:43:35.053-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov BID 107902 CONFIRM https://kb.juniper.net/JSA10929 On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: user@junos> show version | match kernel JUNOS OS Kernel 64-bit [20181214.223829_fbsd-builder_stable_10] Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D236; 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8; 17.3 versions prior to 17.3R2; 17.4 versions prior to 17.4R1-S1, 17.4R1-S7, 17.4R2. This issue does not affect Junos OS releases prior to 15.1.

cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1

CVE-2019-0041

2019-04-10T16:29:00.943-04:00

2019-10-09T19:43:35.337-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10933 On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopback interface (lo0). The device may fail to forward such traffic. This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R1-S2, 18.2R2 on EX4300-MP Series. This issue does not affect any other EX series devices.

CVE-2019-0042

2019-04-10T16:29:00.977-04:00

2019-10-09T19:43:35.570-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10934 Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.

cpe:/o:juniper:junos:12.1x46:- cpe:/o:juniper:junos:12.1x46:d10 cpe:/o:juniper:junos:12.1x46:d15 cpe:/o:juniper:junos:12.1x46:d20 cpe:/o:juniper:junos:12.1x46:d25 cpe:/o:juniper:junos:12.1x46:d30 cpe:/o:juniper:junos:12.1x46:d35 cpe:/o:juniper:junos:12.1x46:d40 cpe:/o:juniper:junos:12.1x46:d45 cpe:/o:juniper:junos:12.1x46:d50 cpe:/o:juniper:junos:12.1x46:d55 cpe:/o:juniper:junos:12.1x46:d60 cpe:/o:juniper:junos:12.1x46:d65 cpe:/o:juniper:junos:12.1x46:d66 cpe:/o:juniper:junos:12.1x46:d67 cpe:/o:juniper:junos:12.1x46:d71 cpe:/o:juniper:junos:12.3 cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r12-s8 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3x48:- cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d20 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:14.1x53:- cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d42 cpe:/o:juniper:junos:14.1x53:d43 cpe:/o:juniper:junos:14.1x53:d44 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d46 cpe:/o:juniper:junos:14.1x53:d47 cpe:/o:juniper:junos:15.1:- cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f6-s1 cpe:/o:juniper:junos:15.1:f6-s10 cpe:/o:juniper:junos:15.1:f6-s2 cpe:/o:juniper:junos:15.1:f6-s3 cpe:/o:juniper:junos:15.1:f6-s4 cpe:/o:juniper:junos:15.1:f6-s5 cpe:/o:juniper:junos:15.1:f6-s6 cpe:/o:juniper:junos:15.1:f6-s7 cpe:/o:juniper:junos:15.1:f6-s8 cpe:/o:juniper:junos:15.1:f6-s9 cpe:/o:juniper:junos:15.1:f7 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1x49:- cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:- cpe:/o:juniper:junos:15.1x53:d10 cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d234 cpe:/o:juniper:junos:15.1x53:d235 cpe:/o:juniper:junos:15.1x53:d236 cpe:/o:juniper:junos:15.1x53:d237 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d50 cpe:/o:juniper:junos:15.1x53:d51 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d57 cpe:/o:juniper:junos:15.1x53:d58 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:15.1x53:d68 cpe:/o:juniper:junos:15.1x54 cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1x65:- cpe:/o:juniper:junos:16.1x65:d30 cpe:/o:juniper:junos:16.1x65:d35 cpe:/o:juniper:junos:16.1x65:d40 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2x75:- cpe:/o:juniper:junos:17.2x75:d50 cpe:/o:juniper:junos:17.2x75:d70 cpe:/o:juniper:junos:17.2x75:d90 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.2x75:-

CVE-2019-0043

2019-04-10T16:29:01.023-04:00

2019-10-09T19:43:35.757-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10935 In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart. By continuously sending a specially crafted SNMP packet, an attacker can repetitively crash the RPD process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS : 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D48 on EX/QFX series; 15.1 versions prior to 15.1R4-S9, 15.1R7-S2; 15.1F6 versions prior to 15.1F6-S11; 15.1X49 versions prior to 15.1X49-D141, 15.1X49-D144, 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX Series; 15.1X53 versions prior to 15.1X53-D590 on EX2300/EX3400 Series; 15.1X54 on ACX Series; 16.1 versions prior to 16.1R3-S10, 16.1R4-S11, 16.1R6-S5, 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S8, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.2X75 versions prior to 17.2X75-D92, 17.2X75-D102, 17.2X75-D110; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 18.1 versions prior to 18.1R1-S1, 18.1R2-S1, 18.1R3; 18.2X75 versions prior to 18.2X75-D10.

CVE-2019-0044

2019-04-10T16:29:01.053-04:00

2019-04-12T02:29:00.330-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 107872 CONFIRM https://kb.juniper.net/JSA10936 Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmcore). By continuously sending a specially crafted packet to the fxp0 interface, an attacker can repetitively crash the rpd process causing prolonged Denial of Service (DoS). Affected releases are Juniper Networks SRX5000 Series: 12.1X46 versions prior to 12.1X46-D82; 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160.

cpe:/a:juniper:junos:18.2:r1 cpe:/a:juniper:junos:18.2:r1-s3 cpe:/a:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r3-s11 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r6-s6 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.2:r2-s7 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s2 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.1:r3-s3 cpe:/o:juniper:junos:18.1:r3-s4 cpe:/o:juniper:junos:18.1:r3-s5 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2:r2-s2 cpe:/o:juniper:junos:18.2:r2-s3 cpe:/o:juniper:junos:18.2:r2-s4

CVE-2019-0046

2019-07-11T16:15:11.177-04:00

2019-10-09T19:43:36.693-04:00

6.1

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 109272 CONFIRM https://kb.juniper.net/JSA10938 A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A reboot of the device is required to restore service. Continued receipt of these valid broadcast packets will create a sustained Denial of Service (DoS) against the device. Affected releases are Juniper Networks Junos OS: 16.1 versions above and including 16.1R1 prior to 16.1R7-S5; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

CVE-2019-0047

2019-10-09T16:15:16.037-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10970 A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue affects: Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.

cpe:/o:juniper:junos:14.1x53:- cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d48 cpe:/o:juniper:junos:14.1x53:d49 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.2:r2-s7 cpe:/o:juniper:junos:17.2:r3-s1 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s2 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2:r2-s2 cpe:/o:juniper:junos:18.2:r2-s3 cpe:/o:juniper:junos:18.2:r2-s4 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.3:r1-s3 cpe:/o:juniper:junos:18.3:r1-s4

CVE-2019-0048

2019-07-11T16:15:11.257-04:00

2019-10-09T19:43:36.960-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10942 On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.x. Due to this bug, when a firewall filter is applied on the loopback interface, other firewall filters might stop working for multicast traffic. The command 'show firewall filter' can be used to confirm whether the filter is working. This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D51, 14.1X53-D115 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3-S2 on EX4300 Series; 17.3 versions prior to 17.3R3-S3 on EX4300 Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on EX4300 Series; 18.1 versions prior to 18.1R3-S1 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series; 18.3 versions prior to 18.3R2 on EX4300 Series.

cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r3-s11 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s1 cpe:/o:juniper:junos:16.2:r2-s2 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r2-s6 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:16.2:r2-s8 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.2x75 cpe:/o:juniper:junos:17.2x75:- cpe:/o:juniper:junos:17.2x75:d102 cpe:/o:juniper:junos:17.2x75:d92 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:18.2:r1-s5 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2x75:- cpe:/o:juniper:junos:18.2x75:d20 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.3:r1-s3

CVE-2019-0049

2019-07-11T16:15:11.333-04:00

2019-10-09T19:43:37.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://kb.juniper.net/JSA10943 On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. Repeated crashes of the RPD process can cause prolonged Denial of Service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S3; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.2X75 versions prior to 17.2X75-D105; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S7, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D12, 18.2X75-D30; 18.3 versions prior to 18.3R1-S4, 18.3R2. Junos OS releases prior to 16.1R1 are not affected.

CVE-2019-0050

2019-10-09T16:15:16.160-04:00

2019-10-09T16:25:33.977-04:00

CONFIRM https://kb.juniper.net/JSA10972 Under certain heavy traffic conditions srxpfe process can crash and result in a denial of service condition for the SRX1500 device. Repeated crashes of the srxpfe can result in an extended denial of service condition. The SRX device may fail to forward traffic when this condition occurs. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D170 on SRX1500; 17.3 versions prior to 17.3R3-S7 on SRX1500; 17.4 versions prior to 17.4R2-S8, 17.4R3 on SRX1500; 18.1 versions prior to 18.1R3-S8 on SRX1500; 18.2 versions prior to 18.2R3 on SRX1500; 18.3 versions prior to 18.3R2 on SRX1500; 18.4 versions prior to 18.4R2 on SRX1500.

CVE-2019-0051

2019-10-09T16:15:16.253-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10973 SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS servers to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition. For this issue to occur, clients protected by the SRX device must initiate a connection to the malicious server. This issue affects: Juniper Networks Junos OS on SRX5000 Series: 12.3X48 versions prior to 12.3X48-D85; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S6, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.

cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:12.3x48:d75 cpe:/o:juniper:junos:15.1x49:- cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d160 cpe:/o:juniper:junos:15.1x49:d170 cpe:/o:juniper:junos:15.1x49:d180 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.3:r3-s3 cpe:/o:juniper:junos:17.3:r3-s4 cpe:/o:juniper:junos:17.3:r3-s5 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r1-s6 cpe:/o:juniper:junos:17.4:r1-s7 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s2 cpe:/o:juniper:junos:17.4:r2-s3 cpe:/o:juniper:junos:17.4:r2-s4 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r2-s4 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.1:r3-s3 cpe:/o:juniper:junos:18.1:r3-s4 cpe:/o:juniper:junos:18.1:r3-s5 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:18.2:r1-s5 cpe:/o:juniper:junos:18.2:r2 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.4:- cpe:/o:juniper:junos:18.4:r1

CVE-2019-0052

2019-07-11T16:15:11.397-04:00

2019-10-09T19:43:37.850-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 109145 CONFIRM https://kb.juniper.net/JSA10946 The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms that support URL-Filtering and have web-filtering enabled. Affected releases are Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 15.1X49 versions prior to 15.1X49-D181, 15.1X49-D190 on SRX Series; 17.3 versions on SRX Series; 17.4 versions prior to 17.4R1-S8, 17.4R2-S5, 17.4R3 on SRX Series; 18.1 versions prior to 18.1R3-S6 on SRX Series; 18.2 versions prior to 18.2R2-S1, 18.2R3 on SRX Series; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on SRX Series.

cpe:/o:juniper:junos:12.3:- cpe:/o:juniper:junos:12.3:r1 cpe:/o:juniper:junos:12.3:r11 cpe:/o:juniper:junos:12.3:r12 cpe:/o:juniper:junos:12.3:r13 cpe:/o:juniper:junos:12.3:r2 cpe:/o:juniper:junos:12.3:r3 cpe:/o:juniper:junos:12.3:r4 cpe:/o:juniper:junos:12.3:r5 cpe:/o:juniper:junos:12.3:r6 cpe:/o:juniper:junos:12.3:r7 cpe:/o:juniper:junos:12.3:r8 cpe:/o:juniper:junos:12.3:r9 cpe:/o:juniper:junos:12.3r12 cpe:/o:juniper:junos:12.3x48:d10 cpe:/o:juniper:junos:12.3x48:d15 cpe:/o:juniper:junos:12.3x48:d25 cpe:/o:juniper:junos:12.3x48:d30 cpe:/o:juniper:junos:12.3x48:d35 cpe:/o:juniper:junos:12.3x48:d40 cpe:/o:juniper:junos:12.3x48:d45 cpe:/o:juniper:junos:12.3x48:d50 cpe:/o:juniper:junos:12.3x48:d55 cpe:/o:juniper:junos:12.3x48:d60 cpe:/o:juniper:junos:12.3x48:d65 cpe:/o:juniper:junos:12.3x48:d70 cpe:/o:juniper:junos:12.3x48:d75 cpe:/o:juniper:junos:14.1x53:- cpe:/o:juniper:junos:14.1x53:d10 cpe:/o:juniper:junos:14.1x53:d15 cpe:/o:juniper:junos:14.1x53:d16 cpe:/o:juniper:junos:14.1x53:d25 cpe:/o:juniper:junos:14.1x53:d26 cpe:/o:juniper:junos:14.1x53:d27 cpe:/o:juniper:junos:14.1x53:d30 cpe:/o:juniper:junos:14.1x53:d35 cpe:/o:juniper:junos:14.1x53:d40 cpe:/o:juniper:junos:14.1x53:d45 cpe:/o:juniper:junos:14.1x53:d48 cpe:/o:juniper:junos:15.1:- cpe:/o:juniper:junos:15.1:a1 cpe:/o:juniper:junos:15.1:f1 cpe:/o:juniper:junos:15.1:f2 cpe:/o:juniper:junos:15.1:f2-s1 cpe:/o:juniper:junos:15.1:f2-s2 cpe:/o:juniper:junos:15.1:f2-s3 cpe:/o:juniper:junos:15.1:f2-s4 cpe:/o:juniper:junos:15.1:f3 cpe:/o:juniper:junos:15.1:f4 cpe:/o:juniper:junos:15.1:f5 cpe:/o:juniper:junos:15.1:f6 cpe:/o:juniper:junos:15.1:f6-s3 cpe:/o:juniper:junos:15.1:r1 cpe:/o:juniper:junos:15.1:r2 cpe:/o:juniper:junos:15.1:r3 cpe:/o:juniper:junos:15.1:r4 cpe:/o:juniper:junos:15.1:r4-s9 cpe:/o:juniper:junos:15.1:r5 cpe:/o:juniper:junos:15.1:r6 cpe:/o:juniper:junos:15.1:r6-s6 cpe:/o:juniper:junos:15.1:r7-s1 cpe:/o:juniper:junos:15.1:r7-s2 cpe:/o:juniper:junos:15.1:r7-s3 cpe:/o:juniper:junos:15.1x49:- cpe:/o:juniper:junos:15.1x49:d10 cpe:/o:juniper:junos:15.1x49:d100 cpe:/o:juniper:junos:15.1x49:d110 cpe:/o:juniper:junos:15.1x49:d120 cpe:/o:juniper:junos:15.1x49:d130 cpe:/o:juniper:junos:15.1x49:d140 cpe:/o:juniper:junos:15.1x49:d150 cpe:/o:juniper:junos:15.1x49:d160 cpe:/o:juniper:junos:15.1x49:d20 cpe:/o:juniper:junos:15.1x49:d30 cpe:/o:juniper:junos:15.1x49:d35 cpe:/o:juniper:junos:15.1x49:d40 cpe:/o:juniper:junos:15.1x49:d45 cpe:/o:juniper:junos:15.1x49:d50 cpe:/o:juniper:junos:15.1x49:d55 cpe:/o:juniper:junos:15.1x49:d60 cpe:/o:juniper:junos:15.1x49:d65 cpe:/o:juniper:junos:15.1x49:d70 cpe:/o:juniper:junos:15.1x49:d75 cpe:/o:juniper:junos:15.1x49:d80 cpe:/o:juniper:junos:15.1x49:d90 cpe:/o:juniper:junos:15.1x53:- cpe:/o:juniper:junos:15.1x53:d20 cpe:/o:juniper:junos:15.1x53:d21 cpe:/o:juniper:junos:15.1x53:d210 cpe:/o:juniper:junos:15.1x53:d230 cpe:/o:juniper:junos:15.1x53:d231 cpe:/o:juniper:junos:15.1x53:d232 cpe:/o:juniper:junos:15.1x53:d233 cpe:/o:juniper:junos:15.1x53:d234 cpe:/o:juniper:junos:15.1x53:d235 cpe:/o:juniper:junos:15.1x53:d236 cpe:/o:juniper:junos:15.1x53:d25 cpe:/o:juniper:junos:15.1x53:d30 cpe:/o:juniper:junos:15.1x53:d32 cpe:/o:juniper:junos:15.1x53:d33 cpe:/o:juniper:junos:15.1x53:d34 cpe:/o:juniper:junos:15.1x53:d40 cpe:/o:juniper:junos:15.1x53:d45 cpe:/o:juniper:junos:15.1x53:d495 cpe:/o:juniper:junos:15.1x53:d52 cpe:/o:juniper:junos:15.1x53:d55 cpe:/o:juniper:junos:15.1x53:d56 cpe:/o:juniper:junos:15.1x53:d59 cpe:/o:juniper:junos:15.1x53:d590 cpe:/o:juniper:junos:15.1x53:d60 cpe:/o:juniper:junos:15.1x53:d61 cpe:/o:juniper:junos:15.1x53:d62 cpe:/o:juniper:junos:15.1x53:d63 cpe:/o:juniper:junos:15.1x53:d64 cpe:/o:juniper:junos:15.1x53:d65 cpe:/o:juniper:junos:15.1x53:d66 cpe:/o:juniper:junos:15.1x53:d67 cpe:/o:juniper:junos:15.1x53:d68 cpe:/o:juniper:junos:15.1x53:d70 cpe:/o:juniper:junos:16.1:- cpe:/o:juniper:junos:16.1:r1 cpe:/o:juniper:junos:16.1:r2 cpe:/o:juniper:junos:16.1:r3 cpe:/o:juniper:junos:16.1:r3-s10 cpe:/o:juniper:junos:16.1:r3-s11 cpe:/o:juniper:junos:16.1:r4 cpe:/o:juniper:junos:16.1:r5 cpe:/o:juniper:junos:16.1:r6 cpe:/o:juniper:junos:16.1:r7 cpe:/o:juniper:junos:16.2:- cpe:/o:juniper:junos:16.2:r1 cpe:/o:juniper:junos:16.2:r2 cpe:/o:juniper:junos:16.2:r2-s1 cpe:/o:juniper:junos:16.2:r2-s2 cpe:/o:juniper:junos:16.2:r2-s5 cpe:/o:juniper:junos:16.2:r2-s6 cpe:/o:juniper:junos:16.2:r2-s7 cpe:/o:juniper:junos:16.2:r2-s8 cpe:/o:juniper:junos:17.1:- cpe:/o:juniper:junos:17.1:r1 cpe:/o:juniper:junos:17.1:r2-s1 cpe:/o:juniper:junos:17.1:r2-s10 cpe:/o:juniper:junos:17.1:r2-s2 cpe:/o:juniper:junos:17.1:r2-s3 cpe:/o:juniper:junos:17.1:r2-s4 cpe:/o:juniper:junos:17.1:r2-s5 cpe:/o:juniper:junos:17.1:r2-s6 cpe:/o:juniper:junos:17.1:r2-s7 cpe:/o:juniper:junos:17.2:- cpe:/o:juniper:junos:17.2:r1 cpe:/o:juniper:junos:17.2:r1-s2 cpe:/o:juniper:junos:17.2:r1-s4 cpe:/o:juniper:junos:17.2:r1-s7 cpe:/o:juniper:junos:17.2:r2 cpe:/o:juniper:junos:17.2:r2-s6 cpe:/o:juniper:junos:17.3:- cpe:/o:juniper:junos:17.3:r1 cpe:/o:juniper:junos:17.3:r2 cpe:/o:juniper:junos:17.3:r2-s1 cpe:/o:juniper:junos:17.3:r2-s2 cpe:/o:juniper:junos:17.3:r3-s1 cpe:/o:juniper:junos:17.3:r3-s2 cpe:/o:juniper:junos:17.3:r3-s3 cpe:/o:juniper:junos:17.4:- cpe:/o:juniper:junos:17.4:r1 cpe:/o:juniper:junos:17.4:r1-s1 cpe:/o:juniper:junos:17.4:r1-s2 cpe:/o:juniper:junos:17.4:r1-s4 cpe:/o:juniper:junos:17.4:r2 cpe:/o:juniper:junos:17.4:r2-s1 cpe:/o:juniper:junos:17.4:r2-s2 cpe:/o:juniper:junos:18.1:- cpe:/o:juniper:junos:18.1:r1 cpe:/o:juniper:junos:18.1:r2 cpe:/o:juniper:junos:18.1:r2-s1 cpe:/o:juniper:junos:18.1:r2-s2 cpe:/o:juniper:junos:18.1:r3 cpe:/o:juniper:junos:18.1:r3-s2 cpe:/o:juniper:junos:18.2:- cpe:/o:juniper:junos:18.2:r1 cpe:/o:juniper:junos:18.2:r1-s3 cpe:/o:juniper:junos:18.2:r1-s4 cpe:/o:juniper:junos:18.2:r2-s1 cpe:/o:juniper:junos:18.2x75:- cpe:/o:juniper:junos:18.2x75:d20 cpe:/o:juniper:junos:18.3:- cpe:/o:juniper:junos:18.3:r1 cpe:/o:juniper:junos:18.3:r1-s1 cpe:/o:juniper:junos:18.3:r1-s2 cpe:/o:juniper:junos:18.4:- cpe:/o:juniper:junos:18.4:r1 cpe:/o:juniper:junos:18.4:r1-s1

CVE-2019-0053

2019-07-11T16:15:11.960-04:00

2019-10-10T08:08:15.613-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153746/FreeBSD-Security-Advisory-FreeBSD-SA-19-12.telnet.html CONFIRM https://kb.juniper.net/JSA10947 BUGTRAQ 20190724 FreeBSD Security Advisory FreeBSD-SA-19:12.telnet FREEBSD FreeBSD-SA-19:12 MISC https://www.exploit-db.com/exploits/45982 Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client ? accessible from the CLI or shell ? in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.

CVE-2019-0054

2019-10-09T16:15:16.347-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10952 MISC https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-application-identification-overview.html An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows an attacker to perform Man-in-the-Middle (MitM) attacks which may compromise the integrity and confidentiality of the device. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D120 on SRX Series devices. No other versions of Junos OS are affected.

CVE-2019-0055

2019-10-09T16:15:16.473-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10953 MLIST https://www.juniper.net/documentation/en_US/junos/topics/topic-map/security-sip-alg.html A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific types of valid SIP traffic to the device. In this case, the flowd process crashes and generates a core dump while processing SIP ALG traffic. Continued receipt of these valid SIP packets will result in a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D61, 12.3X48-D65 on SRX Series; 15.1X49 versions prior to 15.1X49-D130 on SRX Series; 17.3 versions prior to 17.3R3 on SRX Series; 17.4 versions prior to 17.4R2 on SRX Series.

CVE-2019-0056

2019-10-09T16:15:16.583-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10954 This issue only affects devices with three (3) or more MPC10's installed in a single chassis with OSPF enabled and configured on the device. An Insufficient Resource Pool weakness allows an attacker to cause the device's Open Shortest Path First (OSPF) states to transition to Down, resulting in a Denial of Service (DoS) attack. This attack requires a relatively large number of specific Internet Mixed (IMIXed) types of genuine and valid IPv6 packets to be transferred by the attacker in a relatively short period of time, across three or more PFE's on the device at the same time. Continued receipt of the traffic sent by the attacker will continue to cause OSPF to remain in the Down starting state, or flap between other states and then again to Down, causing a persistent Denial of Service. This attack will affect all IPv4, and IPv6 traffic served by the OSPF routes once the OSPF states transition to Down. This issue affects: Juniper Networks Junos OS on MX480, MX960, MX2008, MX2010, MX2020: 18.1 versions prior to 18.1R2-S4, 18.1R3-S5; 18.1X75 version 18.1X75-D10 and later versions; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R1-S4, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.

CVE-2019-0057

2019-10-09T16:15:16.690-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10955 An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager (JDM) application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1, 18.2X75-D5.

CVE-2019-0058

2019-10-09T16:15:16.787-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10956 A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can elevate privileges to gain full control of the system even if they are specifically denied access to perform certain actions. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D80 on SRX Series.

CVE-2019-0059

2019-10-09T16:15:16.893-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10957 A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device. This issue affects: Juniper Networks Junos OS: 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.1X75 all versions. Versions before 18.1R1 are not affected.

CVE-2019-0060

2019-10-09T16:15:16.987-04:00

2019-10-09T16:25:33.977-04:00

MISC https://kb.juniper.net/JSA10959 MISC https://www.juniper.net/documentation/en_US/junos/topics/topic-map/ipsec-tunnel-traffic-configuration.html The flowd process, responsible for forwarding traffic in SRX Series services gateways, may crash and restart when processing specific transit IP packets through an IPSec tunnel. Continued processing of these packets may result in an extended Denial of Service (DoS) condition. This issue only occurs when IPSec tunnels are configured. Systems without IPSec tunnel configurations are not vulnerable to this issue. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180 on SRX Series; 18.2 versions 18.2R2-S1 and later, prior to 18.2R3 on SRX Series; 18.4 versions prior to 18.4R2 on SRX Series.

CVE-2019-0061

2019-10-09T16:15:17.097-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10960 The management daemon (MGD) is responsible for all configuration and management operations in Junos OS. The Junos CLI communicates with MGD over an internal unix-domain socket and is granted special permission to open this protected mode socket. Due to a misconfiguration of the internal socket, a local, authenticated user may be able to exploit this vulnerability to gain administrative privileges. This issue only affects Linux-based platforms. FreeBSD-based platforms are unaffected by this vulnerability. Exploitation of this vulnerability requires Junos shell access. This issue cannot be exploited from the Junos CLI. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D496, 15.1X53-D69; 16.1 versions prior to 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R1-S7, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.

CVE-2019-0062

2019-10-09T16:15:17.223-04:00

2019-10-09T16:25:27.823-04:00

CONFIRM https://kb.juniper.net/JSA10961 A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S5; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2.

CVE-2019-0063

2019-10-09T16:15:17.333-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10962 When an MX Series Broadband Remote Access Server (BRAS) is configured as a Broadband Network Gateway (BNG) with DHCPv6 enabled, jdhcpd might crash when receiving a specific crafted DHCP response message on a subscriber interface. The daemon automatically restarts without intervention, but continuous receipt of specific crafted DHCP messages will repeatedly crash jdhcpd, leading to an extended Denial of Service (DoS) condition. This issue only affects systems configured with DHCPv6 enabled. DHCPv4 is unaffected by this issue. This issue affects Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S5 on MX Series; 16.1 versions prior to 16.1R7-S5 on MX Series; 16.2 versions prior to 16.2R2-S10 on MX Series; 17.1 versions prior to 17.1R3-S1 on MX Series; 17.2 versions prior to 17.2R3-S2 on MX Series; 17.3 versions prior to 17.3R3-S6 on MX Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S6 on MX Series; 18.2 versions prior to 18.2R2-S4, 18.2R3 on MX Series; 18.2X75 versions prior to 18.2X75-D50 on MX Series; 18.3 versions prior to 18.3R1-S5, 18.3R3 on MX Series; 18.4 versions prior to 18.4R2 on MX Series; 19.1 versions prior to 19.1R1-S2, 19.1R2 on MX Series.

CVE-2019-0064

2019-10-09T16:15:17.427-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10963 On SRX5000 Series devices, if 'set security zones security-zone <zone> tcp-rst' is configured, the flowd process may crash when a specific TCP packet is received by the device and triggers a new session. The process restarts automatically. However, receipt of a constant stream of these TCP packets may result in an extended Denial of Service (DoS) condition on the device. This issue affects Juniper Networks Junos OS: 18.2R3 on SRX 5000 Series; 18.4R2 on SRX 5000 Series; 19.2R1 on SRX 5000 Series.

CVE-2019-0065

2019-10-09T16:15:17.520-04:00

2019-10-09T16:25:27.823-04:00

CONFIRM https://kb.juniper.net/JSA10964 On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending a crafted SIP packet, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a sustained Denial of Service. This issue affects Juniper Networks Junos OS on MX Series: 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R3-S6 ; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S3; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.

CVE-2019-0066

2019-10-09T16:15:17.630-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10965 MISC https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/ng-mvpn-services-enabling.html An unexpected status return value weakness in the Next-Generation Multicast VPN (NG-mVPN) service of Juniper Networks Junos OS allows attacker to cause a Denial of Service (DoS) condition and core the routing protocol daemon (rpd) process when a specific malformed IPv4 packet is received by the device running BGP. This malformed packet can be crafted and sent to a victim device including when forwarded directly through a device receiving such a malformed packet, but not if the malformed packet is first de-encapsulated from an encapsulated format by a receiving device. Continued receipt of the malformed packet will result in a sustained Denial of Service condition. This issue affects: Juniper Networks Junos OS 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D68, 15.1X53-D235, 15.1X53-D495, 15.1X53-D590; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S2; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3.

CVE-2019-0067

2019-10-09T16:15:17.723-04:00

2019-10-09T16:25:27.823-04:00

CONFIRM https://kb.juniper.net/JSA10966 Receipt of a specific link-local IPv6 packet destined to the RE may cause the system to crash and restart (vmcore). By continuously sending a specially crafted IPv6 packet, an attacker can repeatedly crash the system causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R6-S2, 16.1R7; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3. This issue does not affect Juniper Networks Junos OS version 15.1 and prior versions.

CVE-2019-0068

2019-10-09T16:15:17.800-04:00

2019-10-09T16:25:27.823-04:00

CONFIRM https://kb.juniper.net/JSA10968 The SRX flowd process, responsible for packet forwarding, may crash and restart when processing specific multicast packets. By continuously sending the specific multicast packets, an attacker can repeatedly crash the flowd process causing a sustained Denial of Service. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D180; 17.3 versions; 17.4 versions prior to 17.4R2-S5, 17.4R3; 18.1 versions prior to 18.1R3-S6; 18.2 versions prior to 18.2R2-S4, 18.2R3; 18.3 versions prior to 18.3R2-S1, 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S1, 19.1R2.

CVE-2019-0069

2019-10-09T16:15:17.910-04:00

2019-10-09T16:25:27.823-04:00

CONFIRM https://kb.juniper.net/JSA10969 On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series, when the user uses console management port to authenticate, the credentials used during device authentication are written to a log file in clear text. This issue does not affect users that are logging-in using telnet, SSH or J-web to the management IP. This issue affects ACX, NFX, SRX, EX and QFX platforms with the Linux Host OS architecture, it does not affect other SRX and EX platforms that do not use the Linux Host OS architecture. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D110 on vSRX, SRX1500, SRX4000 Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5110, QFX5200 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 17.1 versions prior to 17.1R2-S8, 17.1R3, on QFX5110, QFX5200, QFX10K Series; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3 on QFX5110, QFX5200, QFX10K Series; 17.3 versions prior to 17.3R2 on vSRX, SRX1500, SRX4000, QFX5110, QFX5200, QFX10K Series; 14.1X53 versions prior to 14.1X53-D47 on ACX5000, EX4600, QFX5100 Series; 15.1 versions prior to 15.1R7 on ACX5000, EX4600, QFX5100 Series; 16.1R7 versions prior to 16.1R7 on ACX5000, EX4600, QFX5100 Series; 17.1 versions prior to 17.1R2-S10, 17.1R3 on ACX5000, EX4600, QFX5100 Series; 17.2 versions prior to 17.2R3 on ACX5000, EX4600, QFX5100 Series; 17.3 versions prior to 17.3R3 on ACX5000, EX4600, QFX5100 Series; 17.4 versions prior to 17.4R2 on ACX5000, EX4600, QFX5100 Series; 18.1 versions prior to 18.1R2 on ACX5000, EX4600, QFX5100 Series; 15.1X53 versions prior to 15.1X53-D496 on NFX Series, 17.2 versions prior to 17.2R3-S1 on NFX Series; 17.3 versions prior to 17.3R3-S4 on NFX Series; 17.4 versions prior to 17.4R2-S4, 17.4R3 on NFX Series, 18.1 versions prior to 18.1R3-S4 on NFX Series; 18.2 versions prior to 18.2R2-S3, 18.2R3 on NFX Series; 18.3 versions prior to 18.3R1-S3, 18.3R2 on NFX Series; 18.4 versions prior to 18.4R1-S1, 18.4R2 on NFX Series.

CVE-2019-0070

2019-10-09T16:15:18.020-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10977 An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they should not be able to access, and execute commands outside their authorized scope of control. This leads to the attacker being able to take control of the entire system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1 on NFX Series.

CVE-2019-0071

2019-10-09T16:15:18.097-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10978 MISC https://www.juniper.net/documentation/en_US/junos/topics/concept/veriexec.html Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versions of Junos OS, affecting specific EX Series platforms, the Veriexec subsystem will fail to initialize, in essence disabling file integrity checking. This may allow a locally authenticated user with shell access to install untrusted executable images, and elevate privileges to gain full control of the system. During the installation of an affected version of Junos OS are installed, the following messages will be logged to the console: Initializing Verified Exec: /sbin/veriexec: Undefined symbol "__aeabi_uidiv" /sbin/veriexec: Undefined symbol "__aeabi_uidiv" /sbin/veriexec: Undefined symbol "__aeabi_uidiv" veriexec: /.mount/packages/db/os-kernel-prd-arm-32-20190221.70c2600_builder_stable_11/boot/brcm-hr3.dtb: Authentication error veriexec: /.mount/packages/db/os-kernel-prd-arm-32-20190221.70c2600_builder_stable_11/boot/contents.izo: Authentication error ... This issue affects Juniper Networks Junos OS: 18.1R3-S4 on EX2300, EX2300-C and EX3400; 18.3R1-S3 on EX2300, EX2300-C and EX3400.

CVE-2019-0072

2019-10-09T16:15:18.190-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10971 An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4.

CVE-2019-0073

2019-10-09T16:15:18.287-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10974 The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user on the Junos OS device with shell access to read them. This issue affects: Juniper Networks Junos OS 15.1X49 versions prior to 15.1X49-D180; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2.

CVE-2019-0074

2019-10-09T16:15:18.393-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10975 A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2.

CVE-2019-0075

2019-10-09T16:15:18.520-04:00

2019-10-09T16:25:27.823-04:00

MISC https://kb.juniper.net/JSA10976 A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing (PIM) messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases are Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160; 17.3 versions prior to 17.3R3-S7 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R2.

cpe:/a:intel:converged_security_management_engine_firmware:12.0.5 cpe:/o:intel:trusted_execution_engine_firmware:4.0

CVE-2019-0086

2019-05-17T12:29:00.797-04:00

2019-06-20T13:15:10.127-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K35815741 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.

CVE-2019-0088

2019-01-10T15:29:00.517-05:00

2019-02-14T11:07:05.223-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-14T07:56:27.183-05:00

CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00212.html Insufficient path checking in Intel(R) System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access.

cpe:/a:intel:server_platform_services:sps_e3_04.01.04.054.0 cpe:/a:intel:server_platform_services:sps_e5_04.00.04.381.0 cpe:/a:intel:server_platform_services:sps_soc-a_04.00.04.181.0

CVE-2019-0089

2019-05-17T12:29:00.860-04:00

2019-06-19T04:15:10.607-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K47234311 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access.

cpe:/a:intel:server_platform_services:sps_e3_04.01.04.054.0

CVE-2019-0090

2019-05-17T12:29:00.937-04:00

2019-06-20T23:15:09.443-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K59145983 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient access control vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow unauthenticated user to potentially enable escalation of privilege via physical access.

CVE-2019-0091

2019-05-17T12:29:01.017-04:00

2019-06-19T21:15:10.500-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K21423526 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.

cpe:/a:intel:active_management_technology:12.0.5

CVE-2019-0092

2019-05-17T12:29:01.080-04:00

2019-06-20T12:15:11.213-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K84591451 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVE-2019-0093

2019-05-17T12:29:01.140-04:00

2019-06-19T04:15:10.807-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K13710800 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access.

cpe:/a:intel:active_management_technology:12.0.5

CVE-2019-0094

2019-05-17T12:29:01.203-04:00

2019-06-20T12:15:11.383-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

cpe:/a:intel:active_management_technology:12.0.5

CVE-2019-0096

2019-05-17T12:29:01.283-04:00

2019-06-20T12:15:11.493-04:00

5.2

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K84591451 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access.

CVE-2019-0097

2019-05-17T12:29:01.360-04:00

2019-06-20T12:15:11.587-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K84591451 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network access.

cpe:/o:intel:converged_security_management_engine_firmware:12.0.5 cpe:/o:intel:trusted_execution_engine_firmware:4.0

CVE-2019-0098

2019-05-17T12:29:01.423-04:00

2019-06-19T21:15:10.643-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K10522033 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

CVE-2019-0099

2019-05-17T12:29:01.500-04:00

2019-06-20T13:15:10.283-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K30105730 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

cpe:/a:intel:unite:3.2 cpe:/a:intel:unite:3.2.91.51 cpe:/a:intel:unite:3.3

CVE-2019-0101

2019-02-18T12:29:00.363-05:00

2019-02-20T08:41:35.393-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:44:46.413-05:00

BID 107076 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00214.html Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege to the Intel Unite(R) Solution administrative portal via network access.

CVE-2019-0102

2019-02-18T12:29:00.407-05:00

2019-02-28T12:42:18.500-05:00

5.8

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:23:46.533-05:00

BID 107069 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

CVE-2019-0103

2019-02-18T12:29:00.440-05:00

2019-02-28T12:43:16.437-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-28T09:24:02.693-05:00

BID 107074 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2019-0104

2019-02-18T12:29:00.487-05:00

2019-02-28T13:03:51.830-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-28T09:22:39.383-05:00

BID 107109 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2019-0105

2019-02-18T12:29:00.533-05:00

2019-02-28T10:49:48.640-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:22:50.497-05:00

BID 107069 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access.

CVE-2019-0106

2019-02-18T12:29:00.580-05:00

2019-02-28T13:03:01.127-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:22:26.320-05:00

BID 107069 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2019-0107

2019-02-18T12:29:00.627-05:00

2019-02-28T13:47:58.603-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:22:16.787-05:00

BID 107069 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2019-0108

2019-02-18T12:29:00.673-05:00

2019-02-28T13:52:32.810-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-28T09:22:01.723-05:00

BID 107075 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access.

CVE-2019-0109

2019-02-18T12:29:00.720-05:00

2019-02-28T13:59:41.503-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:21:48.753-05:00

BID 107069 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVE-2019-0110

2019-02-18T12:29:00.783-05:00

2019-02-28T14:05:18.647-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-28T09:21:32.423-05:00

BID 107071 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2019-0111

2019-02-18T12:29:00.830-05:00

2019-02-28T14:12:33.597-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-28T09:21:21.220-05:00

BID 107067 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2019-0112

2019-02-18T12:29:00.877-05:00

2019-02-28T14:14:00.840-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-28T09:20:57.873-05:00

BID 107064 MISC https://ics-cert.us-cert.gov/advisories/ICSA-19-050-01 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00215.html Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable a denial of service via local access.

cpe:/a:intel:graphics_driver:15.33.43.4425::~~~windows~~ cpe:/a:intel:graphics_driver:15.33.45.4653::~~~windows~~ cpe:/a:intel:graphics_driver:15.33.46.4885::~~~windows~~ cpe:/a:intel:graphics_driver:15.36.26.4294::~~~windows~~ cpe:/a:intel:graphics_driver:15.36.28.4332::~~~windows~~ cpe:/a:intel:graphics_driver:15.36.31.4414::~~~windows~~ cpe:/a:intel:graphics_driver:15.36.33.4578::~~~windows~~ cpe:/a:intel:graphics_driver:15.36.34.4889::~~~windows~~

CVE-2019-0113

2019-05-17T12:29:01.563-04:00

2019-05-21T11:13:40.803-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-21T07:47:14.777-04:00

BID 108385 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.

CVE-2019-0114

2019-05-17T12:29:01.610-04:00

2019-05-21T11:12:44.520-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-21T07:49:57.067-04:00

BID 108385 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.

CVE-2019-0115

2019-05-17T12:29:01.673-04:00

2019-05-21T10:58:06.440-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-21T07:58:08.817-04:00

BID 108385 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable denial of service via local access.

CVE-2019-0116

2019-05-17T12:29:01.737-04:00

2019-05-21T10:49:10.813-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-21T07:55:06.780-04:00

BID 108385 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00218.html An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access.

cpe:/o:intel:hns2400lp_firmware:- cpe:/o:intel:hns2600bpb24_firmware:- cpe:/o:intel:hns2600bpb_firmware:- cpe:/o:intel:hns2600bpblc24_firmware:- cpe:/o:intel:hns2600bpblc_firmware:- cpe:/o:intel:hns2600bpq24_firmware:- cpe:/o:intel:hns2600bpq_firmware:- cpe:/o:intel:hns2600bps24_firmware:- cpe:/o:intel:hns2600bps_firmware:- cpe:/o:intel:hns2600jf_firmware:- cpe:/o:intel:hns2600jff_firmware:- cpe:/o:intel:hns2600jfq_firmware:- cpe:/o:intel:hns2600kp_firmware:- cpe:/o:intel:hns2600kpf_firmware:- cpe:/o:intel:hns2600kpfr_firmware:- cpe:/o:intel:hns2600kpr_firmware:- cpe:/o:intel:hns2600tp24r_firmware:- cpe:/o:intel:hns2600tp24sr_firmware:- cpe:/o:intel:hns2600tp24str_firmware:- cpe:/o:intel:hns2600tp_firmware:- cpe:/o:intel:hns2600tpf_firmware:- cpe:/o:intel:hns2600tpfr_firmware:- cpe:/o:intel:hns2600tpnr_firmware:- cpe:/o:intel:hns2600tpr_firmware:- cpe:/o:intel:hns2600wp_firmware:- cpe:/o:intel:hns2600wpf_firmware:- cpe:/o:intel:hns2600wpq_firmware:- cpe:/o:intel:hns7200ap_firmware:- cpe:/o:intel:hns7200apl_firmware:- cpe:/o:intel:hns7200apr_firmware:- cpe:/o:intel:hns7200aprl_firmware:- cpe:/o:intel:mfs2600ki_firmware:- cpe:/o:intel:mfs5000si_firmware:- cpe:/o:intel:mfs5520vir_firmware:- cpe:/o:intel:server_board_s1200sp_firmware:- cpe:/o:intel:server_board_s2600bp_firmware:- cpe:/o:intel:server_board_s2600cw_firmware:- cpe:/o:intel:server_board_s2600kp_firmware:- cpe:/o:intel:server_board_s2600st_firmware:- cpe:/o:intel:server_board_s2600tp_firmware:- cpe:/o:intel:server_board_s2600wf_firmware:- cpe:/o:intel:server_board_s2600wt_firmware:- cpe:/o:intel:server_board_s7200ap_firmware:- cpe:/o:intel:server_system_s9200wk_firmware:- cpe:/o:intel:xeon_bronze_processors_firmware:- cpe:/o:intel:xeon_d-1602_firmware:- cpe:/o:intel:xeon_d-1622_firmware:- cpe:/o:intel:xeon_d-1623n_firmware:- cpe:/o:intel:xeon_d-1627_firmware:- cpe:/o:intel:xeon_d-1633n_firmware:- cpe:/o:intel:xeon_d-1637_firmware:- cpe:/o:intel:xeon_d-1649n_firmware:- cpe:/o:intel:xeon_d-1653n_firmware:- cpe:/o:intel:xeon_d-2123it_firmware:- cpe:/o:intel:xeon_d-2141i_firmware:- cpe:/o:intel:xeon_d-2142it_firmware:- cpe:/o:intel:xeon_d-2143it_firmware:- cpe:/o:intel:xeon_d-2145nt_firmware:- cpe:/o:intel:xeon_d-2146nt_firmware:- cpe:/o:intel:xeon_d-2161i_firmware:- cpe:/o:intel:xeon_d-2163it_firmware:- cpe:/o:intel:xeon_d-2166nt_firmware:- cpe:/o:intel:xeon_d-2173it_firmware:- cpe:/o:intel:xeon_d-2177nt_firmware:- cpe:/o:intel:xeon_d-2183it_firmware:- cpe:/o:intel:xeon_d-2187nt_firmware:- cpe:/o:intel:xeon_d-2191_firmware:- cpe:/o:intel:xeon_gold_processors_firmware:- cpe:/o:intel:xeon_platinum_processors_firmware:- cpe:/o:intel:xeon_processor_d-1513n_firmware:- cpe:/o:intel:xeon_processor_d-1518_firmware:- cpe:/o:intel:xeon_processor_d-1520_firmware:- cpe:/o:intel:xeon_processor_d-1521_firmware:- cpe:/o:intel:xeon_processor_d-1523n_firmware:- cpe:/o:intel:xeon_processor_d-1527_firmware:- cpe:/o:intel:xeon_processor_d-1528_firmware:- cpe:/o:intel:xeon_processor_d-1529_firmware:- cpe:/o:intel:xeon_processor_d-1531_firmware:- cpe:/o:intel:xeon_processor_d-1533n_firmware:- cpe:/o:intel:xeon_processor_d-1537_firmware:- cpe:/o:intel:xeon_processor_d-1539_firmware:- cpe:/o:intel:xeon_processor_d-1540_firmware:- cpe:/o:intel:xeon_processor_d-1541_firmware:- cpe:/o:intel:xeon_processor_d-1543n_firmware:- cpe:/o:intel:xeon_processor_d-1548_firmware:- cpe:/o:intel:xeon_processor_d-1553n_firmware:- cpe:/o:intel:xeon_processor_d-1557_firmware:- cpe:/o:intel:xeon_processor_d-1559_firmware:- cpe:/o:intel:xeon_processor_d-1567_firmware:- cpe:/o:intel:xeon_processor_d-1571_firmware:- cpe:/o:intel:xeon_processor_d-1577_firmware:- cpe:/o:intel:xeon_silver_processors_firmware:-

CVE-2019-0119

2019-05-17T12:29:01.783-04:00

2019-06-06T16:29:00.837-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 108485 CONFIRM https://support.f5.com/csp/article/K85585101 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.

cpe:/o:intel:atom_230_firmware:- cpe:/o:intel:atom_330_firmware:- cpe:/o:intel:atom_x5-e3930_firmware:- cpe:/o:intel:atom_x5-e3940_firmware:- cpe:/o:intel:atom_x7-e3950_firmware:- cpe:/o:intel:celeron_j3060_firmware:- cpe:/o:intel:celeron_j3160_firmware:- cpe:/o:intel:celeron_j3355_firmware:- cpe:/o:intel:celeron_j3455_firmware:- cpe:/o:intel:celeron_j4005_firmware:- cpe:/o:intel:celeron_j4105_firmware:- cpe:/o:intel:celeron_n2830_firmware:- cpe:/o:intel:celeron_n2840_firmware:- cpe:/o:intel:celeron_n2930_firmware:- cpe:/o:intel:celeron_n2940_firmware:- cpe:/o:intel:celeron_n3000_firmware:- cpe:/o:intel:celeron_n3350_firmware:- cpe:/o:intel:celeron_n3450_firmware:- cpe:/o:intel:celeron_n4000_firmware:- cpe:/o:intel:celeron_n4100_firmware:- cpe:/o:intel:j3710_firmware:- cpe:/o:intel:j4205_firmware:- cpe:/o:intel:j5005_firmware:- cpe:/o:intel:n3530_firmware:- cpe:/o:intel:n3540_firmware:- cpe:/o:intel:n5000_firmware:- cpe:/o:intel:pentium_silver_j5005_firmware:- cpe:/o:intel:pentium_silver_n5000_firmware:-

CVE-2019-0120

2019-05-17T12:29:01.843-04:00

2019-06-06T04:29:00.397-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 108485 CONFIRM https://support.f5.com/csp/article/K29002929 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access.

cpe:/a:intel:matrix_storage_manager:8.9.0.1023

CVE-2019-0121

2019-03-14T16:29:01.507-04:00

2019-04-18T15:29:02.187-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://support.lenovo.com/us/en/solutions/LEN-26976 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00216.html Improper permissions in Intel(R) Matrix Storage Manager 8.9.0.1023 and before may allow an authenticated user to potentially enable escalation of privilege via local access.

CVE-2019-0122

2019-03-14T16:29:01.537-04:00

2019-03-18T13:02:43.580-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-03-15T08:08:34.293-04:00

CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00217.html Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access.

cpe:/o:intel:xeon_bronze_processors_firmware:- cpe:/o:intel:xeon_d-1602_firmware:- cpe:/o:intel:xeon_d-1622_firmware:- cpe:/o:intel:xeon_d-1623n_firmware:- cpe:/o:intel:xeon_d-1627_firmware:- cpe:/o:intel:xeon_d-1633n_firmware:- cpe:/o:intel:xeon_d-1637_firmware:- cpe:/o:intel:xeon_d-1649n_firmware:- cpe:/o:intel:xeon_d-1653n_firmware:- cpe:/o:intel:xeon_d-2123it_firmware:- cpe:/o:intel:xeon_d-2141i_firmware:- cpe:/o:intel:xeon_d-2142it_firmware:- cpe:/o:intel:xeon_d-2143it_firmware:- cpe:/o:intel:xeon_d-2145nt_firmware:- cpe:/o:intel:xeon_d-2146nt_firmware:- cpe:/o:intel:xeon_d-2161i_firmware:- cpe:/o:intel:xeon_d-2163it_firmware:- cpe:/o:intel:xeon_d-2166nt_firmware:- cpe:/o:intel:xeon_d-2173it_firmware:- cpe:/o:intel:xeon_d-2177nt_firmware:- cpe:/o:intel:xeon_d-2183it_firmware:- cpe:/o:intel:xeon_d-2187nt_firmware:- cpe:/o:intel:xeon_d-2191_firmware:- cpe:/o:intel:xeon_gold_processors_firmware:- cpe:/o:intel:xeon_platinum_processors_firmware:- cpe:/o:intel:xeon_processor_d-1513n_firmware:- cpe:/o:intel:xeon_processor_d-1518_firmware:- cpe:/o:intel:xeon_processor_d-1520_firmware:- cpe:/o:intel:xeon_processor_d-1521_firmware:- cpe:/o:intel:xeon_processor_d-1523n_firmware:- cpe:/o:intel:xeon_processor_d-1527_firmware:- cpe:/o:intel:xeon_processor_d-1528_firmware:- cpe:/o:intel:xeon_processor_d-1529_firmware:- cpe:/o:intel:xeon_processor_d-1531_firmware:- cpe:/o:intel:xeon_processor_d-1533n_firmware:- cpe:/o:intel:xeon_processor_d-1537_firmware:- cpe:/o:intel:xeon_processor_d-1539_firmware:- cpe:/o:intel:xeon_processor_d-1540_firmware:- cpe:/o:intel:xeon_processor_d-1541_firmware:- cpe:/o:intel:xeon_processor_d-1543n_firmware:- cpe:/o:intel:xeon_processor_d-1548_firmware:- cpe:/o:intel:xeon_processor_d-1553n_firmware:- cpe:/o:intel:xeon_processor_d-1557_firmware:- cpe:/o:intel:xeon_processor_d-1559_firmware:- cpe:/o:intel:xeon_processor_d-1567_firmware:- cpe:/o:intel:xeon_processor_d-1571_firmware:- cpe:/o:intel:xeon_processor_d-1577_firmware:- cpe:/o:intel:xeon_silver_processors_firmware:-

CVE-2019-0126

2019-05-17T12:29:01.923-04:00

2019-06-06T21:29:00.507-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 108485 CONFIRM https://support.f5.com/csp/article/K37428370 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00223.html Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.

cpe:/a:intel:openvino:2018:r1.1 cpe:/a:intel:openvino:2018:r1.2 cpe:/a:intel:openvino:2018:r2 cpe:/a:intel:openvino:2018:r3

CVE-2019-0127

2019-02-18T12:29:00.907-05:00

2019-04-01T10:57:11.943-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-01T10:09:27.960-04:00

BID 107110 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00222.html Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access.

CVE-2019-0128

2019-06-13T12:29:00.357-04:00

2019-06-19T00:15:11.470-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 108767 CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27840 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00224.html Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.45 may allow an authenticated user to escalate privilege via local access.

cpe:/a:intel:usb_3.0_creator_utility

CVE-2019-0129

2019-03-14T16:29:01.567-04:00

2019-03-15T11:32:40.040-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-15T07:45:54.077-04:00

CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00229.html Improper permissions for Intel(R) USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

CVE-2019-0130

2019-06-13T12:29:00.403-04:00

2019-06-17T07:16:17.383-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 108775 CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27843 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.

cpe:/a:intel:unite:3.1.0::~~~android~~ cpe:/a:intel:unite:3.1.1::~~~android~~ cpe:/a:intel:unite:3.2 cpe:/a:intel:unite:3.2.91.51 cpe:/a:intel:unite:3.3 cpe:/a:intel:unite:3.3.163.51

CVE-2019-0132

2019-05-17T12:29:01.970-04:00

2019-05-21T06:29:00.237-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 108388 CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27709 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00228.html Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access.

cpe:/a:intel:rapid_storage_technology_enterprise:5.5

CVE-2019-0135

2019-03-14T16:29:01.600-04:00

2019-06-13T12:29:00.513-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27843 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00231.html Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an authenticated user to potentially enable escalation of privilege via local access. L-SA-00206

CVE-2019-0136

2019-06-13T12:29:00.763-04:00

2019-06-24T12:15:10.790-04:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov JVN JVN#75617741 BID 108777 MLIST [debian-lts-announce] 20190914 [SECURITY] [DLA 1919-1] linux-4.9 security update MLIST [debian-lts-announce] 20190915 [SECURITY] [DLA 1919-2] linux-4.9 security update MLIST [debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27828 UBUNTU USN-4115-1 UBUNTU USN-4118-1 UBUNTU USN-4145-1 UBUNTU USN-4147-1 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00232.html Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

cpe:/a:intel:acu_wizard:12.0.0.129

CVE-2019-0138

2019-05-17T12:29:02.047-04:00

2019-05-20T13:23:45.947-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-20T12:15:47.447-04:00

MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00234.html Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.

cpe:/a:intel:converged_security_management_engine_firmware:- cpe:/a:intel:converged_security_management_engine_firmware:12.0.5

CVE-2019-0153

2019-05-17T12:29:02.093-04:00

2019-05-28T18:29:00.267-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K71265658 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Buffer overflow in subsystem in Intel(R) CSME 12.0.0 through 12.0.34 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

CVE-2019-0157

2019-06-13T12:29:00.810-04:00

2019-06-24T12:15:10.883-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 108771 CONFIRM https://support.f5.com/csp/article/K10244523 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00235.html Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access.

cpe:/a:intel:graphics_performance_analyzer:18.4::~~~linux~~

CVE-2019-0158

2019-04-17T14:29:00.277-04:00

2019-04-18T10:28:36.933-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-18T10:01:16.070-04:00

BID 107888 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00236.html Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allow an authenticated user to potentially enable escalation of privilege via local access.

cpe:/a:tianocore:edk_ii:- cpe:/o:opensuse:leap:15.0

CVE-2019-0160

2019-03-27T16:29:03.927-04:00

2019-08-06T13:15:42.337-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1172 REDHAT RHSA-2019:2125 CONFIRM https://edk2-docs.gitbooks.io/security-advisory/content/partitiondxe-and-udf-buffer-overflow.html FEDORA FEDORA-2019-d47a9d4b8b Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.

cpe:/a:tianocore:edk_ii:-

CVE-2019-0161

2019-03-27T16:29:03.957-04:00

2019-05-21T20:29:00.493-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1352 SUSE openSUSE-SU-2019:1425 REDHAT RHSA-2019:2125 REDHAT RHSA-2019:2437 CONFIRM https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html FEDORA FEDORA-2019-d47a9d4b8b Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

cpe:/h:intel:-:-

CVE-2019-0162

2019-04-17T14:29:00.323-04:00

2019-05-07T04:29:00.320-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K26710120 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00238.html Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2019-0163

2019-04-17T14:29:00.387-04:00

2019-04-18T14:50:50.863-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-18T10:57:08.267-04:00

CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00239.html Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access.

cpe:/a:intel:turbo_boost_max_technology_3.0:1.0.0.1035

CVE-2019-0164

2019-06-13T12:29:00.840-04:00

2019-06-17T03:29:00.220-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 108770 CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27841 CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00243.html Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to potentially enable escalation of privilege via local access.

cpe:/a:intel:converged_security_management_engine_firmware:- cpe:/a:intel:converged_security_management_engine_firmware:12.0.5

CVE-2019-0170

2019-05-17T12:29:02.173-04:00

2019-06-20T13:15:10.377-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://support.f5.com/csp/article/K51470205 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2019-0171

2019-05-17T12:29:02.220-04:00

2019-05-21T11:59:56.720-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-21T11:34:03.667-04:00

CONFIRM https://support.f5.com/csp/article/K33245306 MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00244.html Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access.

cpe:/a:intel:unite:3.1.0::~~~android~~ cpe:/a:intel:unite:3.1.1::~~~android~~

CVE-2019-0172

2019-05-17T12:29:02.297-04:00

2019-05-20T14:21:51.110-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-20T11:15:42.820-04:00

MISC https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00245.html A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privilege via network access.

cpe:/a:intel:raid_web_console_2

CVE-2019-0173

2019-08-19T13:15:11.247-04:00

2019-08-27T09:32:46.100-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-26T14:22:42.457-04:00

CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00246.html Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.

cpe:/o:intel:2000e_firmware:- cpe:/o:intel:2002e_firmware:- cpe:/o:intel:2950m_firmware:- cpe:/o:intel:2955u_firmware:- cpe:/o:intel:2957u_firmware:- cpe:/o:intel:2961y_firmware:- cpe:/o:intel:2970m_firmware:- cpe:/o:intel:2980u_firmware:- cpe:/o:intel:2981u_firmware:- cpe:/o:intel:3550m_firmware:- cpe:/o:intel:3556u_firmware:- cpe:/o:intel:3558u_firmware:- cpe:/o:intel:3560m_firmware:- cpe:/o:intel:3560y_firmware:- cpe:/o:intel:3561y_firmware:- cpe:/o:intel:3805u_firmware:- cpe:/o:intel:3825u_firmware:- cpe:/o:intel:e3-1220_firmware:- cpe:/o:intel:e3-1220l_firmware:- cpe:/o:intel:e3-1225_firmware:- cpe:/o:intel:e3-1226_firmware:- cpe:/o:intel:e3-1230_firmware:- cpe:/o:intel:e3-1230l_firmware:- cpe:/o:intel:e3-1231_firmware:- cpe:/o:intel:e3-1240_firmware:- cpe:/o:intel:e3-1240l_firmware:- cpe:/o:intel:e3-1241_firmware:- cpe:/o:intel:e3-1245_firmware:- cpe:/o:intel:e3-1246_firmware:- cpe:/o:intel:e3-1265l_firmware:- cpe:/o:intel:e3-1268l_firmware:- cpe:/o:intel:e3-1270_firmware:- cpe:/o:intel:e3-1271_firmware:- cpe:/o:intel:e3-1275_firmware:- cpe:/o:intel:e3-1275l_firmware:- cpe:/o:intel:e3-1276_firmware:- cpe:/o:intel:e3-1280_firmware:- cpe:/o:intel:e3-1281_firmware:- cpe:/o:intel:e3-1285_firmware:- cpe:/o:intel:e3-1285l_firmware:- cpe:/o:intel:e3-1286_firmware:- cpe:/o:intel:e3-1286l_firmware:- cpe:/o:intel:e5-1428l_firmware:- cpe:/o:intel:e5-1620_firmware:- cpe:/o:intel:e5-1630_firmware:- cpe:/o:intel:e5-1650_firmware:- cpe:/o:intel:e5-1660_firmware:- cpe:/o:intel:e5-1680_firmware:- cpe:/o:intel:e5-2408l_firmware:- cpe:/o:intel:e5-2418l_firmware:- cpe:/o:intel:e5-2428l_firmware:- cpe:/o:intel:e5-2438l_firmware:- cpe:/o:intel:e5-2603_firmware:- cpe:/o:intel:e5-2608l_firmware:- cpe:/o:intel:e5-2609_firmware:- cpe:/o:intel:e5-2618l_firmware:- cpe:/o:intel:e5-2620_firmware:- cpe:/o:intel:e5-2623_firmware:- cpe:/o:intel:e5-2628l_firmware:- cpe:/o:intel:e5-2630_firmware:- cpe:/o:intel:e5-2630l_firmware:- cpe:/o:intel:e5-2637_firmware:- cpe:/o:intel:e5-2640_firmware:- cpe:/o:intel:e5-2643_firmware:- cpe:/o:intel:e5-2648l_firmware:- cpe:/o:intel:e5-2650_firmware:- cpe:/o:intel:e5-2650l_firmware:- cpe:/o:intel:e5-2658_firmware:- cpe:/o:intel:e5-2658a_firmware:- cpe:/o:intel:e5-2660_firmware:- cpe:/o:intel:e5-2667_firmware:- cpe:/o:intel:e5-2670_firmware:- cpe:/o:intel:e5-2680_firmware:- cpe:/o:intel:e5-2683_firmware:- cpe:/o:intel:e5-2687w_firmware:- cpe:/o:intel:e5-2690_firmware:- cpe:/o:intel:e5-2695_firmware:- cpe:/o:intel:e5-2697_firmware:- cpe:/o:intel:e5-2698_firmware:- cpe:/o:intel:e5-2699_firmware:- cpe:/o:intel:e5-4610_firmware:- cpe:/o:intel:e5-4620_firmware:- cpe:/o:intel:e5-4627_firmware:- cpe:/o:intel:e5-4640_firmware:- cpe:/o:intel:e5-4648_firmware:- cpe:/o:intel:e5-4650_firmware:- cpe:/o:intel:e5-4655_firmware:- cpe:/o:intel:e5-4660_firmware:- cpe:/o:intel:e5-4667_firmware:- cpe:/o:intel:e5-4669_firmware:- cpe:/o:intel:e7-4809_firmware:- cpe:/o:intel:e7-4820_firmware:- cpe:/o:intel:e7-4830_firmware:- cpe:/o:intel:e7-4850_firmware:- cpe:/o:intel:e7-8860_firmware:- cpe:/o:intel:e7-8867_firmware:- cpe:/o:intel:e7-8870_firmware:- cpe:/o:intel:e7-8880_firmware:- cpe:/o:intel:e7-8880l_firmware:- cpe:/o:intel:e7-8890_firmware:- cpe:/o:intel:e7-8891_firmware:- cpe:/o:intel:e7-8893_firmware:- cpe:/o:intel:i3-4000m_firmware:- cpe:/o:intel:i3-4005u_firmware:- cpe:/o:intel:i3-4010u_firmware:- cpe:/o:intel:i3-4010y_firmware:- cpe:/o:intel:i3-4012y_firmware:- cpe:/o:intel:i3-4020y_firmware:- cpe:/o:intel:i3-4025u_firmware:- cpe:/o:intel:i3-4030u_firmware:- cpe:/o:intel:i3-4030y_firmware:- cpe:/o:intel:i3-4100e_firmware:- cpe:/o:intel:i3-4100m_firmware:- cpe:/o:intel:i3-4100u_firmware:- cpe:/o:intel:i3-4102e_firmware:- cpe:/o:intel:i3-4110e_firmware:- cpe:/o:intel:i3-4110m_firmware:- cpe:/o:intel:i3-4112e_firmware:- cpe:/o:intel:i3-4120u_firmware:- cpe:/o:intel:i3-4130_firmware:- cpe:/o:intel:i3-4130t_firmware:- cpe:/o:intel:i3-4150_firmware:- cpe:/o:intel:i3-4150t_firmware:- cpe:/o:intel:i3-4158u_firmware:- cpe:/o:intel:i3-4160_firmware:- cpe:/o:intel:i3-4160t_firmware:- cpe:/o:intel:i3-4170_firmware:- cpe:/o:intel:i3-4170t_firmware:- cpe:/o:intel:i3-4330_firmware:- cpe:/o:intel:i3-4330t_firmware:- cpe:/o:intel:i3-4330te_firmware:- cpe:/o:intel:i3-4340_firmware:- cpe:/o:intel:i3-4340te_firmware:- cpe:/o:intel:i3-4350_firmware:- cpe:/o:intel:i3-4350t_firmware:- cpe:/o:intel:i3-4360_firmware:- cpe:/o:intel:i3-4360t_firmware:- cpe:/o:intel:i3-4370_firmware:- cpe:/o:intel:i3-4370t_firmware:- cpe:/o:intel:i5-4200h_firmware:- cpe:/o:intel:i5-4200m_firmware:- cpe:/o:intel:i5-4200u_firmware:- cpe:/o:intel:i5-4200y_firmware:- cpe:/o:intel:i5-4202y_firmware:- cpe:/o:intel:i5-4210h_firmware:- cpe:/o:intel:i5-4210m_firmware:- cpe:/o:intel:i5-4210u_firmware:- cpe:/o:intel:i5-4210y_firmware:- cpe:/o:intel:i5-4220y_firmware:- cpe:/o:intel:i5-4250u_firmware:- cpe:/o:intel:i5-4258u_firmware:- cpe:/o:intel:i5-4260u_firmware:- cpe:/o:intel:i5-4278u_firmware:- cpe:/o:intel:i5-4288u_firmware:- cpe:/o:intel:i5-4300m_firmware:- cpe:/o:intel:i5-4300u_firmware:- cpe:/o:intel:i5-4300y_firmware:- cpe:/o:intel:i5-4302y_firmware:- cpe:/o:intel:i5-4308u_firmware:- cpe:/o:intel:i5-4310m_firmware:- cpe:/o:intel:i5-4310u_firmware:- cpe:/o:intel:i5-4330m_firmware:- cpe:/o:intel:i5-4340m_firmware:- cpe:/o:intel:i5-4350u_firmware:- cpe:/o:intel:i5-4360u_firmware:- cpe:/o:intel:i5-4400e_firmware:- cpe:/o:intel:i5-4402e_firmware:- cpe:/o:intel:i5-4402ec_firmware:- cpe:/o:intel:i5-4410e_firmware:- cpe:/o:intel:i5-4422e_firmware:- cpe:/o:intel:i5-4430s_firmware:- cpe:/o:intel:i5-4440_firmware:- cpe:/o:intel:i5-4440s_firmware:- cpe:/o:intel:i5-4460_firmware:- cpe:/o:intel:i5-4460s_firmware:- cpe:/o:intel:i5-4460t_firmware:- cpe:/o:intel:i7-7800x_firmware:- cpe:/o:intel:i7-7820x_firmware:- cpe:/o:intel:i9-7900x_firmware:- cpe:/o:intel:i9-7920x_firmware:- cpe:/o:intel:i9-7940x_firmware:- cpe:/o:intel:i9-7960x_firmware:- cpe:/o:intel:i9-7980xe_firmware:- cpe:/o:intel:i9-9900x_firmware:- cpe:/o:intel:i9-9920x_firmware:- cpe:/o:intel:i9-9940x_firmware:- cpe:/o:intel:i9-9960x_firmware:- cpe:/o:intel:i9-9980xe_firmware:-

CVE-2019-0174

2019-06-13T12:29:00.887-04:00

2019-06-19T00:15:11.817-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 108731 CONFIRM https://security.netapp.com/advisory/ntap-20190612-0001/ CONFIRM https://support.f5.com/csp/article/K18165180 CONFIRM https://support.lenovo.com/us/en/product_security/LEN-27842 MISC https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00247.html Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0175

2019-06-13T12:29:00.937-04:00

2019-06-24T12:15:12.807-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0177

2019-06-13T12:29:00.983-04:00

2019-06-24T12:15:12.977-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://www.intel.com/content/www/us/en/security-center/advisory/in CONFIRM https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0178

2019-06-13T12:29:01.013-04:00

2019-06-24T12:15:13.103-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

NONE

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0179

2019-06-13T12:29:01.060-04:00

2019-06-24T12:15:13.213-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0180

2019-06-13T12:29:01.107-04:00

2019-06-24T12:15:13.320-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0181

2019-06-13T12:29:01.137-04:00

2019-06-24T12:15:13.430-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0182

2019-06-13T12:29:01.187-04:00

2019-06-24T12:15:13.523-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

cpe:/a:intel:open_cloud_integrity_tehnology:- cpe:/a:intel:openattestation:-

CVE-2019-0183

2019-06-13T12:29:01.233-04:00

2019-06-24T12:15:13.633-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

cpe:/a:apache:pluto:3.0.0 cpe:/a:apache:pluto:3.0.1

CVE-2019-0186

2019-04-26T12:29:00.230-04:00

2019-04-29T09:12:34.220-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-26T14:24:43.107-04:00

MLIST [CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks MISC http://packetstormsecurity.com/files/152642/Apache-Pluto-3.0.0-3.0.1-Cross-Site-Scripting.html BID 108091 MLIST [CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks MISC https://portals.apache.org/pluto/security.html EXPLOIT-DB 46759 MLIST [CVE-2019-0186] The input fields of the Chat Room demo are vulnerable to Cross-Site Scripting (XSS) attacks The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file

cpe:/a:apache:jmeter:4.0 cpe:/a:apache:jmeter:5.0

CVE-2019-0187

2019-03-06T12:29:00.383-05:00

2019-03-07T12:37:37.257-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-07T08:30:14.503-05:00

MLIST [jmeter-user] 20190302 [SECURITY] CVE-2019-0187: Apache JMeter Missing client auth for RMI connection when distributed test is used BID 107219 Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.

cpe:/a:apache:camel:1.0.0 cpe:/a:apache:camel:1.1.0 cpe:/a:apache:camel:1.2.0 cpe:/a:apache:camel:1.3.0 cpe:/a:apache:camel:1.4.0 cpe:/a:apache:camel:1.5.0 cpe:/a:apache:camel:1.6.0 cpe:/a:apache:camel:1.6.1 cpe:/a:apache:camel:1.6.2 cpe:/a:apache:camel:1.6.3 cpe:/a:apache:camel:1.6.4 cpe:/a:apache:camel:2.0.0 cpe:/a:apache:camel:2.0.0:m1 cpe:/a:apache:camel:2.0.0:m2 cpe:/a:apache:camel:2.0.0:m3 cpe:/a:apache:camel:2.1.0 cpe:/a:apache:camel:2.2.0 cpe:/a:apache:camel:2.3.0 cpe:/a:apache:camel:2.4.0 cpe:/a:apache:camel:2.5.0 cpe:/a:apache:camel:2.6.0 cpe:/a:apache:camel:2.7.0 cpe:/a:apache:camel:2.7.1 cpe:/a:apache:camel:2.7.2 cpe:/a:apache:camel:2.7.3 cpe:/a:apache:camel:2.7.4 cpe:/a:apache:camel:2.7.5 cpe:/a:apache:camel:2.8.0 cpe:/a:apache:camel:2.8.1 cpe:/a:apache:camel:2.8.2 cpe:/a:apache:camel:2.8.3 cpe:/a:apache:camel:2.8.4 cpe:/a:apache:camel:2.8.5 cpe:/a:apache:camel:2.8.6 cpe:/a:apache:camel:2.9.0 cpe:/a:apache:camel:2.9.1 cpe:/a:apache:camel:2.9.2 cpe:/a:apache:camel:2.9.3 cpe:/a:apache:camel:2.9.4 cpe:/a:apache:camel:2.9.5 cpe:/a:apache:camel:2.9.6 cpe:/a:apache:camel:2.9.7 cpe:/a:apache:camel:2.9.8 cpe:/a:apache:camel:2.10.0 cpe:/a:apache:camel:2.10.1 cpe:/a:apache:camel:2.10.2 cpe:/a:apache:camel:2.10.3 cpe:/a:apache:camel:2.10.4 cpe:/a:apache:camel:2.10.5 cpe:/a:apache:camel:2.10.6 cpe:/a:apache:camel:2.10.7 cpe:/a:apache:camel:2.11.0 cpe:/a:apache:camel:2.11.1 cpe:/a:apache:camel:2.11.2 cpe:/a:apache:camel:2.11.3 cpe:/a:apache:camel:2.11.4 cpe:/a:apache:camel:2.12.0 cpe:/a:apache:camel:2.12.1 cpe:/a:apache:camel:2.12.2 cpe:/a:apache:camel:2.12.3 cpe:/a:apache:camel:2.12.4 cpe:/a:apache:camel:2.12.5 cpe:/a:apache:camel:2.13.0 cpe:/a:apache:camel:2.13.1 cpe:/a:apache:camel:2.13.2 cpe:/a:apache:camel:2.13.3 cpe:/a:apache:camel:2.13.4 cpe:/a:apache:camel:2.14.0 cpe:/a:apache:camel:2.14.1 cpe:/a:apache:camel:2.14.2 cpe:/a:apache:camel:2.14.3 cpe:/a:apache:camel:2.14.4 cpe:/a:apache:camel:2.15.0 cpe:/a:apache:camel:2.15.1 cpe:/a:apache:camel:2.15.2 cpe:/a:apache:camel:2.15.3 cpe:/a:apache:camel:2.15.4 cpe:/a:apache:camel:2.16.0 cpe:/a:apache:camel:2.16.1 cpe:/a:apache:camel:2.16.2 cpe:/a:apache:camel:2.16.3 cpe:/a:apache:camel:2.16.4 cpe:/a:apache:camel:2.17.0 cpe:/a:apache:camel:2.17.1 cpe:/a:apache:camel:2.17.2 cpe:/a:apache:camel:2.17.3 cpe:/a:apache:camel:2.17.4 cpe:/a:apache:camel:2.17.5 cpe:/a:apache:camel:2.18.0 cpe:/a:apache:camel:2.18.1 cpe:/a:apache:camel:2.18.2 cpe:/a:apache:camel:2.18.3 cpe:/a:apache:camel:2.18.4 cpe:/a:apache:camel:2.18.5 cpe:/a:apache:camel:2.19.0 cpe:/a:apache:camel:2.19.1 cpe:/a:apache:camel:2.19.2 cpe:/a:apache:camel:2.19.3 cpe:/a:apache:camel:2.19.4 cpe:/a:apache:camel:2.19.5 cpe:/a:apache:camel:2.20.0 cpe:/a:apache:camel:2.20.1 cpe:/a:apache:camel:2.20.2 cpe:/a:apache:camel:2.20.3 cpe:/a:apache:camel:2.20.4 cpe:/a:apache:camel:2.21.0 cpe:/a:apache:camel:2.21.1 cpe:/a:apache:camel:2.21.2 cpe:/a:apache:camel:2.21.3 cpe:/a:apache:camel:2.21.4 cpe:/a:apache:camel:2.21.5 cpe:/a:apache:camel:2.22.0 cpe:/a:apache:camel:2.22.1 cpe:/a:apache:camel:2.22.2 cpe:/a:apache:camel:2.22.3 cpe:/a:apache:camel:2.22.4 cpe:/a:apache:camel:2.23.0 cpe:/a:apache:camel:2.23.1 cpe:/a:apache:camel:2.23.2

CVE-2019-0188

2019-05-28T15:29:02.550-04:00

2019-06-07T05:29:00.263-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov JVN JVN#71498764 MLIST [oss-security] 20190524 [SECURITY][ERRATA-CORRIGE] New security advisory CVE-2019-0188 released for Apache Camel BID 108422 CONFIRM https://github.com/apache/camel/blob/master/docs/user-manual/en/security-advisories/CVE-2019-0188.txt.asc MLIST [camel-users] 20190524 [SECURITY][ERRATA-CORRIGE] New security advisory CVE-2019-0188 released for Apache Camel MLIST [tamaya-dev] 20190607 [jira] [Created] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188 MLIST [tamaya-commits] 20190607 [incubator-tamaya-sandbox] branch master updated: TAMAYA-410 bump camel-core version past CVE-2019-0188 MLIST [tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] peculater merged pull request #30: TAMAYA-410 bump camel-core version past CVE-2019-0188 MLIST [tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] ottlinger commented on issue #30: TAMAYA-410 bump camel-core version past CVE-2019-0188 MLIST [tamaya-commits] 20190607 [GitHub] [incubator-tamaya-sandbox] peculater opened a new pull request #30: TAMAYA-410 bump camel-core version past CVE-2019-0188 MLIST [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. MLIST [tamaya-dev] 20190607 [jira] [Commented] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188 MLIST [tamaya-dev] 20190607 [jira] [Closed] (TAMAYA-410) Update camel-core dependency past CVE-2019-0188 Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.

cpe:/a:apache:ofbiz:16.11.01 cpe:/a:apache:ofbiz:16.11.02 cpe:/a:apache:ofbiz:16.11.03 cpe:/a:apache:ofbiz:16.11.04 cpe:/a:apache:ofbiz:16.11.05

CVE-2019-0189

2019-09-11T17:15:10.953-04:00

2019-09-13T13:03:27.790-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-09-13T11:23:55.677-04:00

MLIST [ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-10837) Improve ObjectInputStream class (CVE-2019-0189) MLIST [ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-10770) Update Apache commons-fileupload to last version (CVE-2019-0189) MLIST [ofbiz-dev] 20190910 [CVE-2019-0189] Apache OFBiz remote code execution and arbitrary file delete via Java The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16

cpe:/a:apache:http_server:2.4.37 cpe:/a:netapp:santricity_cloud_connector:- cpe:/a:openssl:openssl:1.1.1 cpe:/a:openssl:openssl:1.1.1:pre1 cpe:/a:openssl:openssl:1.1.1:pre2 cpe:/a:openssl:openssl:1.1.1:pre3 cpe:/a:openssl:openssl:1.1.1:pre4 cpe:/a:openssl:openssl:1.1.1:pre5 cpe:/a:openssl:openssl:1.1.1:pre6 cpe:/a:openssl:openssl:1.1.1:pre7 cpe:/a:openssl:openssl:1.1.1:pre8 cpe:/a:openssl:openssl:1.1.1:pre9 cpe:/a:openssl:openssl:1.1.1a cpe:/a:openssl:openssl:1.1.1b cpe:/a:openssl:openssl:1.1.1c cpe:/a:oracle:enterprise_manager_ops_center:12.3.3

CVE-2019-0190

2019-01-30T17:29:00.497-05:00

2019-07-23T19:15:34.757-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106743 CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html GENTOO GLSA-201903-21 CONFIRM https://security.netapp.com/advisory/ntap-20190125-0001/ MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

cpe:/a:apache:karaf:2.0.0 cpe:/a:apache:karaf:2.1.0 cpe:/a:apache:karaf:2.1.1 cpe:/a:apache:karaf:2.1.2 cpe:/a:apache:karaf:2.1.3 cpe:/a:apache:karaf:2.1.4 cpe:/a:apache:karaf:2.1.5 cpe:/a:apache:karaf:2.1.6 cpe:/a:apache:karaf:2.2.0 cpe:/a:apache:karaf:2.2.1 cpe:/a:apache:karaf:2.2.2 cpe:/a:apache:karaf:2.2.3 cpe:/a:apache:karaf:2.2.4 cpe:/a:apache:karaf:2.2.5 cpe:/a:apache:karaf:2.2.6 cpe:/a:apache:karaf:2.2.7 cpe:/a:apache:karaf:2.2.8 cpe:/a:apache:karaf:2.2.9 cpe:/a:apache:karaf:2.2.10 cpe:/a:apache:karaf:2.2.11 cpe:/a:apache:karaf:2.3.0 cpe:/a:apache:karaf:2.3.1 cpe:/a:apache:karaf:2.3.2 cpe:/a:apache:karaf:2.3.3 cpe:/a:apache:karaf:2.3.4 cpe:/a:apache:karaf:2.3.5 cpe:/a:apache:karaf:2.3.6 cpe:/a:apache:karaf:2.3.7 cpe:/a:apache:karaf:2.3.8 cpe:/a:apache:karaf:2.3.9 cpe:/a:apache:karaf:2.3.10 cpe:/a:apache:karaf:2.3.11 cpe:/a:apache:karaf:2.3.12 cpe:/a:apache:karaf:2.4.0 cpe:/a:apache:karaf:2.4.1 cpe:/a:apache:karaf:2.4.2 cpe:/a:apache:karaf:2.4.3 cpe:/a:apache:karaf:2.4.4 cpe:/a:apache:karaf:3.0.0 cpe:/a:apache:karaf:3.0.0:rc1 cpe:/a:apache:karaf:3.0.1 cpe:/a:apache:karaf:3.0.2 cpe:/a:apache:karaf:3.0.3 cpe:/a:apache:karaf:3.0.4 cpe:/a:apache:karaf:3.0.5 cpe:/a:apache:karaf:3.0.6 cpe:/a:apache:karaf:3.0.7 cpe:/a:apache:karaf:3.0.8 cpe:/a:apache:karaf:3.0.9 cpe:/a:apache:karaf:4.0.0 cpe:/a:apache:karaf:4.0.0:milestone1 cpe:/a:apache:karaf:4.0.0:milestone2 cpe:/a:apache:karaf:4.0.0:milestone3 cpe:/a:apache:karaf:4.0.1 cpe:/a:apache:karaf:4.0.2 cpe:/a:apache:karaf:4.0.3 cpe:/a:apache:karaf:4.0.4 cpe:/a:apache:karaf:4.0.5 cpe:/a:apache:karaf:4.0.6 cpe:/a:apache:karaf:4.0.7 cpe:/a:apache:karaf:4.0.8 cpe:/a:apache:karaf:4.0.9 cpe:/a:apache:karaf:4.0.10 cpe:/a:apache:karaf:4.1.0 cpe:/a:apache:karaf:4.1.1 cpe:/a:apache:karaf:4.1.2 cpe:/a:apache:karaf:4.1.3 cpe:/a:apache:karaf:4.1.4 cpe:/a:apache:karaf:4.1.5 cpe:/a:apache:karaf:4.1.6 cpe:/a:apache:karaf:4.1.7 cpe:/a:apache:karaf:4.2.0 cpe:/a:apache:karaf:4.2.0:milestone1 cpe:/a:apache:karaf:4.2.0:milestone2 cpe:/a:apache:karaf:4.2.1 cpe:/a:apache:karaf:4.2.2

CVE-2019-0191

2019-03-21T12:01:01.827-04:00

2019-05-06T05:29:00.280-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107462 MLIST [karaf-user] 20190307 [SECURITY] New security advisory for CVE-2019-0191 released for Apache Karaf MLIST [karaf-commits] 20190506 [karaf-site] branch trunk updated: Publish CVE-2019-0226 Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.

cpe:/a:apache:solr:5.1 cpe:/a:apache:solr:5.1.0 cpe:/a:apache:solr:5.2.0 cpe:/a:apache:solr:5.2.1 cpe:/a:apache:solr:5.3 cpe:/a:apache:solr:5.3.0 cpe:/a:apache:solr:5.3.1 cpe:/a:apache:solr:5.3.2 cpe:/a:apache:solr:5.4.0 cpe:/a:apache:solr:5.4.1 cpe:/a:apache:solr:5.5.0 cpe:/a:apache:solr:5.5.1 cpe:/a:apache:solr:5.5.2 cpe:/a:apache:solr:5.5.3 cpe:/a:apache:solr:5.5.4 cpe:/a:apache:solr:5.5.5 cpe:/a:apache:solr:6.0.0 cpe:/a:apache:solr:6.0.1 cpe:/a:apache:solr:6.1.0 cpe:/a:apache:solr:6.2.0 cpe:/a:apache:solr:6.2.1 cpe:/a:apache:solr:6.3.0 cpe:/a:apache:solr:6.4.0 cpe:/a:apache:solr:6.4.1 cpe:/a:apache:solr:6.4.2 cpe:/a:apache:solr:6.5.0 cpe:/a:apache:solr:6.5.1 cpe:/a:apache:solr:6.6.0 cpe:/a:apache:solr:6.6.1 cpe:/a:apache:solr:6.6.2 cpe:/a:apache:solr:6.6.3 cpe:/a:apache:solr:6.6.4 cpe:/a:apache:solr:6.6.5 cpe:/a:netapp:storage_automation_store:-

CVE-2019-0192

2019-03-07T16:29:00.203-05:00

2019-07-23T19:15:34.943-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [www-announce] 20190307 CVE-2019-0192 Deserialization of untrusted data via jmx.serviceUrl in Apache Solr BID 107318 REDHAT RHSA-2019:2413 MLIST [lucene-dev] 20190320 [jira] [Issue Comment Deleted] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl MLIST [lucene-dev] 20190327 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl MLIST [lucene-dev] 20190320 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl MLIST [lucene-dev] 20190326 [jira] [Updated] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl MLIST [lucene-dev] 20190326 [jira] [Commented] (SOLR-13301) [CVE-2019-0192] Deserialization of untrusted data via jmx.serviceUrl CONFIRM https://security.netapp.com/advisory/ntap-20190327-0003/ MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.

cpe:/a:apache:solr:1.1.0 cpe:/a:apache:solr:1.2 cpe:/a:apache:solr:1.3.0 cpe:/a:apache:solr:1.4.0 cpe:/a:apache:solr:1.4.1 cpe:/a:apache:solr:3.1 cpe:/a:apache:solr:3.2 cpe:/a:apache:solr:3.3 cpe:/a:apache:solr:3.4.0 cpe:/a:apache:solr:3.5.0 cpe:/a:apache:solr:3.6.0 cpe:/a:apache:solr:3.6.1 cpe:/a:apache:solr:3.6.2 cpe:/a:apache:solr:4.0.0 cpe:/a:apache:solr:4.0.0:alpha cpe:/a:apache:solr:4.0.0:beta cpe:/a:apache:solr:4.1.0 cpe:/a:apache:solr:4.2.0 cpe:/a:apache:solr:4.2.1 cpe:/a:apache:solr:4.3.0 cpe:/a:apache:solr:4.3.1 cpe:/a:apache:solr:4.4.0 cpe:/a:apache:solr:4.5.0 cpe:/a:apache:solr:4.5.1 cpe:/a:apache:solr:4.6.0 cpe:/a:apache:solr:4.6.1 cpe:/a:apache:solr:4.7.0 cpe:/a:apache:solr:4.7.1 cpe:/a:apache:solr:4.7.2 cpe:/a:apache:solr:4.8.0 cpe:/a:apache:solr:4.8.1 cpe:/a:apache:solr:4.9.0 cpe:/a:apache:solr:4.9.1 cpe:/a:apache:solr:4.10.0 cpe:/a:apache:solr:4.10.1 cpe:/a:apache:solr:4.10.2 cpe:/a:apache:solr:4.10.3 cpe:/a:apache:solr:4.10.4 cpe:/a:apache:solr:5.0 cpe:/a:apache:solr:5.1 cpe:/a:apache:solr:5.1.0 cpe:/a:apache:solr:5.2.0 cpe:/a:apache:solr:5.2.1 cpe:/a:apache:solr:5.3 cpe:/a:apache:solr:5.3.0 cpe:/a:apache:solr:5.3.1 cpe:/a:apache:solr:5.3.2 cpe:/a:apache:solr:5.4.0 cpe:/a:apache:solr:5.4.1 cpe:/a:apache:solr:5.5.0 cpe:/a:apache:solr:5.5.1 cpe:/a:apache:solr:5.5.2 cpe:/a:apache:solr:5.5.3 cpe:/a:apache:solr:5.5.4 cpe:/a:apache:solr:5.5.5 cpe:/a:apache:solr:6.0.0 cpe:/a:apache:solr:6.0.1 cpe:/a:apache:solr:6.1.0 cpe:/a:apache:solr:6.2.0 cpe:/a:apache:solr:6.2.1 cpe:/a:apache:solr:6.3.0 cpe:/a:apache:solr:6.4.0 cpe:/a:apache:solr:6.4.1 cpe:/a:apache:solr:6.4.2 cpe:/a:apache:solr:6.5.0 cpe:/a:apache:solr:6.5.1 cpe:/a:apache:solr:6.6.0 cpe:/a:apache:solr:6.6.1 cpe:/a:apache:solr:6.6.2 cpe:/a:apache:solr:6.6.3 cpe:/a:apache:solr:6.6.4 cpe:/a:apache:solr:6.6.5 cpe:/a:apache:solr:7.0.0 cpe:/a:apache:solr:7.0.1 cpe:/a:apache:solr:7.1.0 cpe:/a:apache:solr:7.2.0 cpe:/a:apache:solr:7.2.1 cpe:/a:apache:solr:7.3.0 cpe:/a:apache:solr:7.3.1 cpe:/a:apache:solr:7.4.0 cpe:/a:apache:solr:7.5.0 cpe:/a:apache:solr:7.6.0 cpe:/a:apache:solr:7.7.0 cpe:/a:apache:solr:7.7.1 cpe:/a:apache:solr:7.7.2 cpe:/a:apache:solr:8.0.0 cpe:/a:apache:solr:8.1.0 cpe:/a:apache:solr:8.1.1

CVE-2019-0193

2019-08-01T10:15:13.113-04:00

2019-10-10T17:15:10.030-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM https://issues.apache.org/jira/browse/SOLR-13669 MLIST [debian-lts-announce] 20191010 [SECURITY] [DLA 1954-1] lucene-solr security update In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

cpe:/a:apache:camel:2.0.0 cpe:/a:apache:camel:2.0.0:m1 cpe:/a:apache:camel:2.0.0:m2 cpe:/a:apache:camel:2.0.0:m3 cpe:/a:apache:camel:2.1.0 cpe:/a:apache:camel:2.2.0 cpe:/a:apache:camel:2.3.0 cpe:/a:apache:camel:2.4.0 cpe:/a:apache:camel:2.5.0 cpe:/a:apache:camel:2.6.0 cpe:/a:apache:camel:2.7.0 cpe:/a:apache:camel:2.7.1 cpe:/a:apache:camel:2.7.2 cpe:/a:apache:camel:2.7.3 cpe:/a:apache:camel:2.7.4 cpe:/a:apache:camel:2.7.5 cpe:/a:apache:camel:2.8.0 cpe:/a:apache:camel:2.8.1 cpe:/a:apache:camel:2.8.2 cpe:/a:apache:camel:2.8.3 cpe:/a:apache:camel:2.8.4 cpe:/a:apache:camel:2.8.5 cpe:/a:apache:camel:2.8.6 cpe:/a:apache:camel:2.9.0 cpe:/a:apache:camel:2.9.1 cpe:/a:apache:camel:2.9.2 cpe:/a:apache:camel:2.9.3 cpe:/a:apache:camel:2.9.4 cpe:/a:apache:camel:2.9.5 cpe:/a:apache:camel:2.9.6 cpe:/a:apache:camel:2.9.7 cpe:/a:apache:camel:2.9.8 cpe:/a:apache:camel:2.10.0 cpe:/a:apache:camel:2.10.1 cpe:/a:apache:camel:2.10.2 cpe:/a:apache:camel:2.10.3 cpe:/a:apache:camel:2.10.4 cpe:/a:apache:camel:2.10.5 cpe:/a:apache:camel:2.10.6 cpe:/a:apache:camel:2.10.7 cpe:/a:apache:camel:2.11.0 cpe:/a:apache:camel:2.11.1 cpe:/a:apache:camel:2.11.2 cpe:/a:apache:camel:2.11.3 cpe:/a:apache:camel:2.11.4 cpe:/a:apache:camel:2.12.0 cpe:/a:apache:camel:2.12.1 cpe:/a:apache:camel:2.12.2 cpe:/a:apache:camel:2.12.3 cpe:/a:apache:camel:2.12.4 cpe:/a:apache:camel:2.12.5 cpe:/a:apache:camel:2.13.0 cpe:/a:apache:camel:2.13.1 cpe:/a:apache:camel:2.13.2 cpe:/a:apache:camel:2.13.3 cpe:/a:apache:camel:2.13.4 cpe:/a:apache:camel:2.14.0 cpe:/a:apache:camel:2.14.1 cpe:/a:apache:camel:2.14.2 cpe:/a:apache:camel:2.14.3 cpe:/a:apache:camel:2.14.4 cpe:/a:apache:camel:2.15.0 cpe:/a:apache:camel:2.15.1 cpe:/a:apache:camel:2.15.2 cpe:/a:apache:camel:2.15.3 cpe:/a:apache:camel:2.15.4 cpe:/a:apache:camel:2.16.0 cpe:/a:apache:camel:2.16.1 cpe:/a:apache:camel:2.16.2 cpe:/a:apache:camel:2.16.3 cpe:/a:apache:camel:2.16.4 cpe:/a:apache:camel:2.17.0 cpe:/a:apache:camel:2.17.1 cpe:/a:apache:camel:2.17.2 cpe:/a:apache:camel:2.17.3 cpe:/a:apache:camel:2.17.4 cpe:/a:apache:camel:2.17.5 cpe:/a:apache:camel:2.18.0 cpe:/a:apache:camel:2.18.1 cpe:/a:apache:camel:2.18.2 cpe:/a:apache:camel:2.18.3 cpe:/a:apache:camel:2.18.4 cpe:/a:apache:camel:2.18.5 cpe:/a:apache:camel:2.19.0 cpe:/a:apache:camel:2.21.0 cpe:/a:apache:camel:2.21.1 cpe:/a:apache:camel:2.21.2 cpe:/a:apache:camel:2.21.3 cpe:/a:apache:camel:2.22.0 cpe:/a:apache:camel:2.22.1 cpe:/a:apache:camel:2.22.2 cpe:/a:apache:camel:2.23.0

CVE-2019-0194

2019-04-30T18:29:00.607-04:00

2019-05-24T07:29:03.640-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190430 [SECURITY] New security advisory CVE-2019-0194 released for Apache Camel BID 108181 MLIST [camel-users] 20190430 [SECURITY] New security advisory CVE-2019-0194 released for Apache Camel MLIST [camel-commits] 20190524 [camel] branch master updated: Added security advisory for CVE-2019-0188 MLIST [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html MLIST [camel-commits] 20190430 [camel] branch master updated: Added CVE-2019-0194 details MLIST [camel-commits] 20190524 [camel] 02/02: CVE-2019-0188 - Changed the title in security advisories MISC https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76@%3Cdev.camel.apache.org%3E MLIST [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.

cpe:/a:apache:tapestry:5.4.0 cpe:/a:apache:tapestry:5.4.1 cpe:/a:apache:tapestry:5.4.2 cpe:/a:apache:tapestry:5.4.3

CVE-2019-0195

2019-09-16T12:15:10.007-04:00

2019-10-07T12:15:10.773-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [tapestry-users] 20190913 [CVE-2019-0195] Apache Tapestry vulnerability disclosure MLIST [tapestry-users] 20191014 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure MLIST [tapestry-users] 20191007 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.

cpe:/a:apache:http_server:2.4.17 cpe:/a:apache:http_server:2.4.18 cpe:/a:apache:http_server:2.4.19 cpe:/a:apache:http_server:2.4.20 cpe:/a:apache:http_server:2.4.21 cpe:/a:apache:http_server:2.4.22 cpe:/a:apache:http_server:2.4.23 cpe:/a:apache:http_server:2.4.24 cpe:/a:apache:http_server:2.4.25 cpe:/a:apache:http_server:2.4.26 cpe:/a:apache:http_server:2.4.27 cpe:/a:apache:http_server:2.4.28 cpe:/a:apache:http_server:2.4.29 cpe:/a:apache:http_server:2.4.30 cpe:/a:apache:http_server:2.4.32 cpe:/a:apache:http_server:2.4.33 cpe:/a:apache:http_server:2.4.34 cpe:/a:apache:http_server:2.4.35 cpe:/a:apache:http_server:2.4.36 cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:9.0

CVE-2019-0196

2019-06-11T18:29:03.747-04:00

2019-06-17T15:15:10.250-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1190 SUSE openSUSE-SU-2019:1209 SUSE openSUSE-SU-2019:1258 MISC http://www.apache.org/dist/httpd/CHANGES_2.4.39 MLIST [oss-security] 20190401 CVE-2019-0196: mod_http2, read-after-free on a string compare BID 107669 CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190611 svn commit: r1046148 - in /websites/production/httpd/content: ./ mail MLIST [httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml FEDORA FEDORA-2019-cf7695b470 FEDORA FEDORA-2019-c7187e6dc7 FEDORA FEDORA-2019-08e57d15fd BUGTRAQ 20190403 [SECURITY] [DSA 4422-1] apache2 security update CONFIRM https://security.netapp.com/advisory/ntap-20190617-0002/ CONFIRM https://support.f5.com/csp/article/K44591505 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us UBUNTU USN-3937-1 DEBIAN DSA-4422 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

CVE-2019-0197

2019-06-11T18:29:04.170-04:00

2019-06-17T15:15:10.517-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1190 SUSE openSUSE-SU-2019:1209 SUSE openSUSE-SU-2019:1258 MLIST [oss-security] 20190401 CVE-2019-0197: mod_http2, possible crash on late upgrade BID 107665 CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MISC https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E FEDORA FEDORA-2019-cf7695b470 CONFIRM https://security.netapp.com/advisory/ntap-20190617-0002/ CONFIRM https://support.f5.com/csp/article/K44591505 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us UBUNTU USN-4113-1 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVE-2019-0198

2019-03-21T14:15:06.410-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none.

cpe:/a:apache:tomcat:8.5.0 cpe:/a:apache:tomcat:8.5.1 cpe:/a:apache:tomcat:8.5.2 cpe:/a:apache:tomcat:8.5.3 cpe:/a:apache:tomcat:8.5.4 cpe:/a:apache:tomcat:8.5.5 cpe:/a:apache:tomcat:8.5.6 cpe:/a:apache:tomcat:8.5.7 cpe:/a:apache:tomcat:8.5.8 cpe:/a:apache:tomcat:8.5.9 cpe:/a:apache:tomcat:8.5.10 cpe:/a:apache:tomcat:8.5.11 cpe:/a:apache:tomcat:8.5.12 cpe:/a:apache:tomcat:8.5.13 cpe:/a:apache:tomcat:8.5.14 cpe:/a:apache:tomcat:8.5.15 cpe:/a:apache:tomcat:8.5.16 cpe:/a:apache:tomcat:8.5.17 cpe:/a:apache:tomcat:8.5.18 cpe:/a:apache:tomcat:8.5.19 cpe:/a:apache:tomcat:8.5.20 cpe:/a:apache:tomcat:8.5.21 cpe:/a:apache:tomcat:8.5.22 cpe:/a:apache:tomcat:8.5.23 cpe:/a:apache:tomcat:8.5.24 cpe:/a:apache:tomcat:8.5.25 cpe:/a:apache:tomcat:8.5.26 cpe:/a:apache:tomcat:8.5.27 cpe:/a:apache:tomcat:8.5.28 cpe:/a:apache:tomcat:8.5.29 cpe:/a:apache:tomcat:8.5.30 cpe:/a:apache:tomcat:8.5.31 cpe:/a:apache:tomcat:8.5.32 cpe:/a:apache:tomcat:8.5.33 cpe:/a:apache:tomcat:8.5.34 cpe:/a:apache:tomcat:8.5.35 cpe:/a:apache:tomcat:8.5.36 cpe:/a:apache:tomcat:8.5.37 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/a:apache:tomcat:9.0.0:m10 cpe:/a:apache:tomcat:9.0.0:m11 cpe:/a:apache:tomcat:9.0.0:m12 cpe:/a:apache:tomcat:9.0.0:m13 cpe:/a:apache:tomcat:9.0.0:m14 cpe:/a:apache:tomcat:9.0.0:m15 cpe:/a:apache:tomcat:9.0.0:m16 cpe:/a:apache:tomcat:9.0.0:m17 cpe:/a:apache:tomcat:9.0.0:m18 cpe:/a:apache:tomcat:9.0.0:m19 cpe:/a:apache:tomcat:9.0.0:m2 cpe:/a:apache:tomcat:9.0.0:m20 cpe:/a:apache:tomcat:9.0.0:m21 cpe:/a:apache:tomcat:9.0.0:m3 cpe:/a:apache:tomcat:9.0.0:m4 cpe:/a:apache:tomcat:9.0.0:m5 cpe:/a:apache:tomcat:9.0.0:m6 cpe:/a:apache:tomcat:9.0.0:m7 cpe:/a:apache:tomcat:9.0.0:m8 cpe:/a:apache:tomcat:9.0.0:m9 cpe:/a:apache:tomcat:9.0.1 cpe:/a:apache:tomcat:9.0.2 cpe:/a:apache:tomcat:9.0.3 cpe:/a:apache:tomcat:9.0.4 cpe:/a:apache:tomcat:9.0.5 cpe:/a:apache:tomcat:9.0.6 cpe:/a:apache:tomcat:9.0.7 cpe:/a:apache:tomcat:9.0.8 cpe:/a:apache:tomcat:9.0.9 cpe:/a:apache:tomcat:9.0.10 cpe:/a:apache:tomcat:9.0.11 cpe:/a:apache:tomcat:9.0.12 cpe:/a:apache:tomcat:9.0.13 cpe:/a:apache:tomcat:9.0.14

CVE-2019-0199

2019-04-10T11:29:00.390-04:00

2019-05-28T17:29:00.420-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1673 SUSE openSUSE-SU-2019:1723 SUSE openSUSE-SU-2019:1808 BID 107674 MLIST [tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml MLIST [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MLIST [tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS MISC https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E MLIST [tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199 MLIST [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS FEDORA FEDORA-2019-d66febb5df FEDORA FEDORA-2019-1a3f878d27 CONFIRM https://security.netapp.com/advisory/ntap-20190419-0001/ CONFIRM https://support.f5.com/csp/article/K17321505 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

cpe:/a:apache:qpid_broker-j:6.0.0 cpe:/a:apache:qpid_broker-j:6.0.1 cpe:/a:apache:qpid_broker-j:6.0.2 cpe:/a:apache:qpid_broker-j:6.0.3 cpe:/a:apache:qpid_broker-j:6.0.4 cpe:/a:apache:qpid_broker-j:6.0.5 cpe:/a:apache:qpid_broker-j:6.0.6 cpe:/a:apache:qpid_broker-j:6.0.7 cpe:/a:apache:qpid_broker-j:6.0.8 cpe:/a:apache:qpid_broker-j:6.1.0 cpe:/a:apache:qpid_broker-j:6.1.1 cpe:/a:apache:qpid_broker-j:6.1.2 cpe:/a:apache:qpid_broker-j:6.1.3 cpe:/a:apache:qpid_broker-j:6.1.4 cpe:/a:apache:qpid_broker-j:6.1.5 cpe:/a:apache:qpid_broker-j:6.1.6 cpe:/a:apache:qpid_broker-j:6.1.7 cpe:/a:apache:qpid_broker-j:7.0.0 cpe:/a:apache:qpid_broker-j:7.0.1 cpe:/a:apache:qpid_broker-j:7.0.2 cpe:/a:apache:qpid_broker-j:7.0.3 cpe:/a:apache:qpid_broker-j:7.0.4 cpe:/a:apache:qpid_broker-j:7.0.5 cpe:/a:apache:qpid_broker-j:7.0.6 cpe:/a:apache:qpid_broker-j:7.1.0

CVE-2019-0200

2019-03-06T13:29:00.247-05:00

2019-03-07T15:13:42.423-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-07T10:47:13.453-05:00

BID 107215 MLIST [qpid-users] 20190301 [SECURITY] CVE-2019-0200: Apache Qpid Broker-J Denial of Service due to malformed AMQP 0-8 to 0-10 commands A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.

cpe:/a:apache:zookeeper:1.0.0 cpe:/a:apache:zookeeper:3.0.0 cpe:/a:apache:zookeeper:3.0.1 cpe:/a:apache:zookeeper:3.1.0 cpe:/a:apache:zookeeper:3.1.1 cpe:/a:apache:zookeeper:3.1.2 cpe:/a:apache:zookeeper:3.2.0 cpe:/a:apache:zookeeper:3.2.1 cpe:/a:apache:zookeeper:3.2.2 cpe:/a:apache:zookeeper:3.3.0 cpe:/a:apache:zookeeper:3.3.1 cpe:/a:apache:zookeeper:3.3.2 cpe:/a:apache:zookeeper:3.3.3 cpe:/a:apache:zookeeper:3.3.4 cpe:/a:apache:zookeeper:3.3.5 cpe:/a:apache:zookeeper:3.3.6 cpe:/a:apache:zookeeper:3.4.0 cpe:/a:apache:zookeeper:3.4.1 cpe:/a:apache:zookeeper:3.4.2 cpe:/a:apache:zookeeper:3.4.3 cpe:/a:apache:zookeeper:3.4.4 cpe:/a:apache:zookeeper:3.4.4:- cpe:/a:apache:zookeeper:3.4.4:rc0 cpe:/a:apache:zookeeper:3.4.5 cpe:/a:apache:zookeeper:3.4.5:- cpe:/a:apache:zookeeper:3.4.5:rc0 cpe:/a:apache:zookeeper:3.4.5:rc1 cpe:/a:apache:zookeeper:3.4.6 cpe:/a:apache:zookeeper:3.4.6:- cpe:/a:apache:zookeeper:3.4.6:rc0 cpe:/a:apache:zookeeper:3.4.7 cpe:/a:apache:zookeeper:3.4.7:- cpe:/a:apache:zookeeper:3.4.7:rc0 cpe:/a:apache:zookeeper:3.4.8 cpe:/a:apache:zookeeper:3.4.8:- cpe:/a:apache:zookeeper:3.4.8:rc0 cpe:/a:apache:zookeeper:3.4.9 cpe:/a:apache:zookeeper:3.4.9:- cpe:/a:apache:zookeeper:3.4.9:rc0 cpe:/a:apache:zookeeper:3.4.9:rc1 cpe:/a:apache:zookeeper:3.4.9:rc2 cpe:/a:apache:zookeeper:3.4.10:- cpe:/a:apache:zookeeper:3.4.10:rc0 cpe:/a:apache:zookeeper:3.4.10:rc1 cpe:/a:apache:zookeeper:3.4.11:- cpe:/a:apache:zookeeper:3.4.11:rc0 cpe:/a:apache:zookeeper:3.4.11:rc1 cpe:/a:apache:zookeeper:3.4.12:- cpe:/a:apache:zookeeper:3.4.12:rc0 cpe:/a:apache:zookeeper:3.4.12:rc1 cpe:/a:apache:zookeeper:3.4.13:- cpe:/a:apache:zookeeper:3.4.13:rc0 cpe:/a:apache:zookeeper:3.4.13:rc1 cpe:/a:apache:zookeeper:3.5.0:- cpe:/a:apache:zookeeper:3.5.0:alpha cpe:/a:apache:zookeeper:3.5.0:rc0 cpe:/a:apache:zookeeper:3.5.1:- cpe:/a:apache:zookeeper:3.5.1:alpha cpe:/a:apache:zookeeper:3.5.1:rc0 cpe:/a:apache:zookeeper:3.5.1:rc1 cpe:/a:apache:zookeeper:3.5.1:rc2 cpe:/a:apache:zookeeper:3.5.1:rc3 cpe:/a:apache:zookeeper:3.5.1:rc4 cpe:/a:apache:zookeeper:3.5.2:- cpe:/a:apache:zookeeper:3.5.2:alpha cpe:/a:apache:zookeeper:3.5.2:rc0 cpe:/a:apache:zookeeper:3.5.2:rc1 cpe:/a:apache:zookeeper:3.5.3:- cpe:/a:apache:zookeeper:3.5.3:beta cpe:/a:apache:zookeeper:3.5.3:rc0 cpe:/a:apache:zookeeper:3.5.3:rc1 cpe:/a:apache:zookeeper:3.5.4:beta cpe:/o:debian:debian_linux:8.0

CVE-2019-0201

2019-05-23T10:29:07.517-04:00

2019-10-10T08:08:21.457-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 108427 MISC https://issues.apache.org/jira/browse/ZOOKEEPER-1392 MLIST [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar MLIST [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201) MLIST [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5 MLIST [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update BUGTRAQ 20190612 [SECURITY] [DSA 4461-1] zookeeper security update CONFIRM https://security.netapp.com/advisory/ntap-20190619-0001/ DEBIAN DSA-4461 CONFIRM https://zookeeper.apache.org/security.html#CVE-2019-0201 An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

cpe:/a:apache:storm:0.9.1:incubating cpe:/a:apache:storm:0.9.2:incubating cpe:/a:apache:storm:0.9.3 cpe:/a:apache:storm:0.9.4 cpe:/a:apache:storm:0.9.5 cpe:/a:apache:storm:0.9.6 cpe:/a:apache:storm:0.9.7 cpe:/a:apache:storm:0.10.0 cpe:/a:apache:storm:0.10.0:beta cpe:/a:apache:storm:0.10.1 cpe:/a:apache:storm:0.10.2 cpe:/a:apache:storm:1.0 cpe:/a:apache:storm:1.0.0 cpe:/a:apache:storm:1.0.1 cpe:/a:apache:storm:1.0.2 cpe:/a:apache:storm:1.0.3 cpe:/a:apache:storm:1.0.4 cpe:/a:apache:storm:1.0.5 cpe:/a:apache:storm:1.0.6 cpe:/a:apache:storm:1.0.7 cpe:/a:apache:storm:1.1 cpe:/a:apache:storm:1.1.0 cpe:/a:apache:storm:1.1.1 cpe:/a:apache:storm:1.1.2 cpe:/a:apache:storm:1.1.3 cpe:/a:apache:storm:1.2.0 cpe:/a:apache:storm:1.2.1 cpe:/a:apache:storm:1.2.2

CVE-2019-0202

2019-07-25T20:15:11.027-04:00

2019-10-09T19:43:43.133-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [storm-user] 20190724 [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.

cpe:/a:apache:subversion:1.9.10 cpe:/a:apache:subversion:1.10.0 cpe:/a:apache:subversion:1.10.0:alpha1 cpe:/a:apache:subversion:1.10.0:alpha2 cpe:/a:apache:subversion:1.10.0:alpha3 cpe:/a:apache:subversion:1.10.0:rc1 cpe:/a:apache:subversion:1.10.0:rc2 cpe:/a:apache:subversion:1.10.2 cpe:/a:apache:subversion:1.10.3 cpe:/a:apache:subversion:1.10.4 cpe:/a:apache:subversion:1.11.0 cpe:/a:apache:subversion:1.11.0:rc2 cpe:/a:apache:subversion:1.11.1 cpe:/a:apache:subversion:1.12.0

CVE-2019-0203

2019-09-26T12:15:10.440-04:00

2019-09-27T11:33:28.073-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-09-27T11:26:23.477-04:00

MISC http://subversion.apache.org/security/CVE-2019-0203-advisory.txt In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

cpe:/a:apache:mesos:1.4.0 cpe:/a:apache:mesos:1.4.0:- cpe:/a:apache:mesos:1.4.0:rc1 cpe:/a:apache:mesos:1.4.0:rc2 cpe:/a:apache:mesos:1.4.0:rc3 cpe:/a:apache:mesos:1.4.0:rc4 cpe:/a:apache:mesos:1.4.0:rc5 cpe:/a:apache:mesos:1.4.1 cpe:/a:apache:mesos:1.4.1:- cpe:/a:apache:mesos:1.4.1:rc1 cpe:/a:apache:mesos:1.4.2 cpe:/a:apache:mesos:1.4.2:- cpe:/a:apache:mesos:1.4.2:rc1 cpe:/a:apache:mesos:1.5.0 cpe:/a:apache:mesos:1.5.0:- cpe:/a:apache:mesos:1.5.0:rc1 cpe:/a:apache:mesos:1.5.0:rc2 cpe:/a:apache:mesos:1.5.1 cpe:/a:apache:mesos:1.5.1:- cpe:/a:apache:mesos:1.5.1:rc1 cpe:/a:apache:mesos:1.5.2:- cpe:/a:apache:mesos:1.5.2:rc1 cpe:/a:apache:mesos:1.5.2:rc2 cpe:/a:apache:mesos:1.5.2:rc3 cpe:/a:apache:mesos:1.6.0 cpe:/a:apache:mesos:1.6.0:- cpe:/a:apache:mesos:1.6.0:rc1 cpe:/a:apache:mesos:1.6.1 cpe:/a:apache:mesos:1.6.1:- cpe:/a:apache:mesos:1.6.1:rc1 cpe:/a:apache:mesos:1.6.1:rc2 cpe:/a:apache:mesos:1.7.0 cpe:/a:apache:mesos:1.7.0:- cpe:/a:apache:mesos:1.7.0:rc1 cpe:/a:apache:mesos:1.7.0:rc2 cpe:/a:apache:mesos:1.7.0:rc3 cpe:/a:apache:mesos:1.7.1:- cpe:/a:apache:mesos:1.7.1:rc1 cpe:/a:apache:mesos:1.7.1:rc2 cpe:/a:apache:mesos:1.8.0:dev

CVE-2019-0204

2019-03-25T18:29:00.730-04:00

2019-03-28T09:45:15.167-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-26T15:12:06.953-04:00

BID 107605 MLIST [mesos-dev] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible. A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.

CVE-2019-0206

2019-03-14T18:15:10.163-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

cpe:/a:apache:tapestry:5.4.0 cpe:/a:apache:tapestry:5.4.1 cpe:/a:apache:tapestry:5.4.2 cpe:/a:apache:tapestry:5.4.3 cpe:/a:apache:tapestry:5.4.4

CVE-2019-0207

2019-09-16T13:15:13.183-04:00

2019-10-07T12:15:10.960-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [tapestry-users] 20190913 CVE-2019-0207: Apache Tapestry vulnerability disclosure MLIST [tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

CVE-2019-0208

2019-04-10T15:15:08.917-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

CVE-2019-0209

2019-06-10T11:15:09.140-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

CVE-2019-0211

2019-04-08T18:29:00.387-04:00

2019-06-11T18:29:04.420-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2019:1190 SUSE openSUSE-SU-2019:1209 SUSE openSUSE-SU-2019:1258 MISC http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html MISC http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html MISC http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html MISC http://www.apache.org/dist/httpd/CHANGES_2.4.39 MLIST [oss-security] 20190401 CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts MLIST [oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2 BID 107666 REDHAT RHBA-2019:0959 REDHAT RHSA-2019:0746 REDHAT RHSA-2019:0980 REDHAT RHSA-2019:1296 REDHAT RHSA-2019:1297 REDHAT RHSA-2019:1543 MISC https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [community-dev] 20190411 CVE-2019-0211 applicable to versions 2.2.x? MLIST [httpd-users] 20190406 [users@httpd] CVE-2019-0211/0215/0217 MLIST [community-dev] 20190411 Re: CVE-2019-0211 applicable to versions 2.2.x? MLIST [community-dev] 20190411 RE: CVE-2019-0211 applicable to versions 2.2.x? MLIST [httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml FEDORA FEDORA-2019-a4ed7400f4 FEDORA FEDORA-2019-119b14075a FEDORA FEDORA-2019-cf7695b470 BUGTRAQ 20190407 [slackware-security] httpd (SSA:2019-096-01) BUGTRAQ 20190403 [SECURITY] [DSA 4422-1] apache2 security update GENTOO GLSA-201904-20 CONFIRM https://security.netapp.com/advisory/ntap-20190423-0001/ CONFIRM https://support.f5.com/csp/article/K32957101 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us UBUNTU USN-3937-1 DEBIAN DSA-4422 EXPLOIT-DB 46676 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html CONFIRM https://www.synology.com/security/advisory/Synology_SA_19_14 In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

cpe:/a:apache:hbase:2.0.0 cpe:/a:apache:hbase:2.0.0:- cpe:/a:apache:hbase:2.0.0:alpha1 cpe:/a:apache:hbase:2.0.0:alpha2 cpe:/a:apache:hbase:2.0.0:alpha3 cpe:/a:apache:hbase:2.0.0:beta1 cpe:/a:apache:hbase:2.0.0:beta2 cpe:/a:apache:hbase:2.0.1 cpe:/a:apache:hbase:2.0.2 cpe:/a:apache:hbase:2.0.3 cpe:/a:apache:hbase:2.0.4 cpe:/a:apache:hbase:2.1.0 cpe:/a:apache:hbase:2.1.1 cpe:/a:apache:hbase:2.1.2 cpe:/a:apache:hbase:2.1.3

CVE-2019-0212

2019-03-28T18:29:00.370-04:00

2019-04-05T12:48:38.527-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-04-04T12:11:03.493-04:00

MLIST [oss-security] 20190327 [CVE-2019-0212] Apache HBase REST Server incorrect user authorization BID 107624 CONFIRM https://lists.apache.org/thread.html/66535e15007cda8f9308eec10e12ffe349e0b8b55e56ec6ee02b71d2@%3Cdev.hbase.apache.org%3E In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.

cpe:/a:apache:archiva:1.2 cpe:/a:apache:archiva:1.2.1 cpe:/a:apache:archiva:1.2.2 cpe:/a:apache:archiva:1.3 cpe:/a:apache:archiva:1.3.1 cpe:/a:apache:archiva:1.3.2 cpe:/a:apache:archiva:1.3.3 cpe:/a:apache:archiva:1.3.4 cpe:/a:apache:archiva:1.3.5 cpe:/a:apache:archiva:1.3.6 cpe:/a:apache:archiva:1.3.8 cpe:/a:apache:archiva:1.3.9 cpe:/a:apache:archiva:2.0.0 cpe:/a:apache:archiva:2.0.1 cpe:/a:apache:archiva:2.1.0 cpe:/a:apache:archiva:2.1.1 cpe:/a:apache:archiva:2.2.0 cpe:/a:apache:archiva:2.2.1 cpe:/a:apache:archiva:2.2.2 cpe:/a:apache:archiva:2.2.3

CVE-2019-0213

2019-04-30T18:29:00.793-04:00

2019-05-06T16:29:00.663-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov MISC http://archiva.apache.org/security.html#CVE-2019-0213 MISC http://packetstormsecurity.com/files/152681/Apache-Archiva-2.2.3-Cross-Site-Scripting.html MLIST [oss-security] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS BID 108123 MLIST [archiva-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS MLIST [announce] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS MLIST [archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0 MLIST [maven-users] 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS BUGTRAQ 20190430 [SECURITY] CVE-2019-0213: Apache Archiva Stored XSS In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva server must be compromised.

CVE-2019-0214

2019-04-30T18:29:01.027-04:00

2019-05-03T15:44:35.220-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-05-02T15:51:08.790-04:00

CONFIRM http://archiva.apache.org/security.html#CVE-2019-0214 MISC http://packetstormsecurity.com/files/152684/Apache-Archiva-2.2.3-File-Write-Delete.html MLIST [oss-security] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server BID 108124 MLIST [announce] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server MLIST [maven-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server MLIST [archiva-users] 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server MLIST [archiva-issues] 20190501 [jira] [Created] (MRM-1987) Port security fixes for 2.2.4 to 3.0.0 BUGTRAQ 20190430 [SECURITY] CVE-2019-0214: Apache Archiva arbitrary file write and delete on the server In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.

cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/o:fedoraproject:fedora:29 cpe:/o:fedoraproject:fedora:30

CVE-2019-0215

2019-04-08T16:29:10.003-04:00

2019-05-13T23:29:03.240-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20190401 CVE-2019-0215: mod_ssl access control bypass BID 107667 REDHAT RHSA-2019:0980 MISC https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-dev] 20190804 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t MLIST [httpd-cvs] 20190402 svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-dev] 20190806 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190806 svn commit: r1864463 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t FEDORA FEDORA-2019-a4ed7400f4 FEDORA FEDORA-2019-119b14075a FEDORA FEDORA-2019-cf7695b470 CONFIRM https://security.netapp.com/advisory/ntap-20190423-0001/ CONFIRM https://support.f5.com/csp/article/K59440504 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

cpe:/a:apache:airflow:1.10.2

CVE-2019-0216

2019-04-10T16:29:01.083-04:00

2019-04-11T13:29:01.150-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component BID 107869 MISC https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.

cpe:/a:apache:http_server:2.4.38 cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0 cpe:/o:fedoraproject:fedora:29 cpe:/o:fedoraproject:fedora:30 cpe:/o:opensuse:leap:15.0 cpe:/o:opensuse:leap:42.3 cpe:/o:redhat:enterprise_linux:7.0

CVE-2019-0217

2019-04-08T17:29:00.843-04:00

2019-05-13T23:29:03.847-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1190 SUSE openSUSE-SU-2019:1209 SUSE openSUSE-SU-2019:1258 MLIST [oss-security] 20190401 CVE-2019-0217: mod_auth_digest access control bypass BID 107668 REDHAT RHSA-2019:2343 MISC https://bugzilla.redhat.com/show_bug.cgi?id=1695020 MISC https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-dev] 20190402 re: svn commit: r33393 - /release/httpd/CHANGES_2.4 MLIST [debian-lts-announce] 20190403 [SECURITY] [DLA 1748-1] apache2 security update FEDORA FEDORA-2019-a4ed7400f4 FEDORA FEDORA-2019-119b14075a FEDORA EDORA-2019-cf7695b470 BUGTRAQ 20190403 [SECURITY] [DSA 4422-1] apache2 security update CONFIRM https://security.netapp.com/advisory/ntap-20190423-0001/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us UBUNTU USN-3937-1 UBUNTU USN-3937-2 DEBIAN DSA-4422 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

cpe:/a:apache:pony_mail:0.8 cpe:/a:apache:pony_mail:0.9 cpe:/a:apache:pony_mail:0.10

CVE-2019-0218

2019-04-22T18:29:00.230-04:00

2019-04-26T13:07:55.843-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-23T14:26:54.927-04:00

BID 108046 MLIST [ponymail-users] 20190420 [CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS MLIST [oss-security] 20190420 [CVE-2019-0218] Apache Pony Mail (incubating) Reflected XSS A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.

cpe:/a:apache:http_server:2.4.0 cpe:/a:apache:http_server:2.4.1 cpe:/a:apache:http_server:2.4.2 cpe:/a:apache:http_server:2.4.3 cpe:/a:apache:http_server:2.4.4 cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7 cpe:/a:apache:http_server:2.4.8 cpe:/a:apache:http_server:2.4.9 cpe:/a:apache:http_server:2.4.10 cpe:/a:apache:http_server:2.4.12 cpe:/a:apache:http_server:2.4.14 cpe:/a:apache:http_server:2.4.16 cpe:/a:apache:http_server:2.4.17 cpe:/a:apache:http_server:2.4.18 cpe:/a:apache:http_server:2.4.19 cpe:/a:apache:http_server:2.4.20 cpe:/a:apache:http_server:2.4.21 cpe:/a:apache:http_server:2.4.22 cpe:/a:apache:http_server:2.4.23 cpe:/a:apache:http_server:2.4.24 cpe:/a:apache:http_server:2.4.25 cpe:/a:apache:http_server:2.4.26 cpe:/a:apache:http_server:2.4.27 cpe:/a:apache:http_server:2.4.28 cpe:/a:apache:http_server:2.4.29 cpe:/a:apache:http_server:2.4.30 cpe:/a:apache:http_server:2.4.32 cpe:/a:apache:http_server:2.4.33 cpe:/a:apache:http_server:2.4.34 cpe:/a:apache:http_server:2.4.35 cpe:/a:apache:http_server:2.4.36 cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0 cpe:/o:fedoraproject:fedora:28 cpe:/o:fedoraproject:fedora:29 cpe:/o:fedoraproject:fedora:30 cpe:/o:opensuse:leap:15.0 cpe:/o:opensuse:leap:42.3

CVE-2019-0220

2019-06-11T17:29:00.630-04:00

2019-06-25T06:15:10.627-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2019:1190 SUSE openSUSE-SU-2019:1209 SUSE openSUSE-SU-2019:1258 MLIST [oss-security] 20190401 CVE-2019-0220: URL normalization inconsistincies BID 107670 REDHAT RHSA-2019:2343 CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [debian-lts-announce] 20190403 [SECURITY] [DLA 1748-1] apache2 security update FEDORA FEDORA-2019-a4ed7400f4 FEDORA FEDORA-2019-119b14075a FEDORA FEDORA-2019-cf7695b470 BUGTRAQ 20190403 [SECURITY] [DSA 4422-1] apache2 security update CONFIRM https://security.netapp.com/advisory/ntap-20190625-0007/ CONFIRM https://support.f5.com/csp/article/K44591505 CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us UBUNTU USN-3937-1 DEBIAN DSA-4422 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.5:beta cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.51 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:7.0.55 cpe:/a:apache:tomcat:7.0.56 cpe:/a:apache:tomcat:7.0.57 cpe:/a:apache:tomcat:7.0.58 cpe:/a:apache:tomcat:7.0.59 cpe:/a:apache:tomcat:7.0.60 cpe:/a:apache:tomcat:7.0.61 cpe:/a:apache:tomcat:7.0.62 cpe:/a:apache:tomcat:7.0.63 cpe:/a:apache:tomcat:7.0.64 cpe:/a:apache:tomcat:7.0.65 cpe:/a:apache:tomcat:7.0.66 cpe:/a:apache:tomcat:7.0.67 cpe:/a:apache:tomcat:7.0.68 cpe:/a:apache:tomcat:7.0.69 cpe:/a:apache:tomcat:7.0.70 cpe:/a:apache:tomcat:7.0.71 cpe:/a:apache:tomcat:7.0.72 cpe:/a:apache:tomcat:7.0.73 cpe:/a:apache:tomcat:7.0.74 cpe:/a:apache:tomcat:7.0.75 cpe:/a:apache:tomcat:7.0.76 cpe:/a:apache:tomcat:7.0.77 cpe:/a:apache:tomcat:7.0.78 cpe:/a:apache:tomcat:7.0.79 cpe:/a:apache:tomcat:7.0.80 cpe:/a:apache:tomcat:7.0.81 cpe:/a:apache:tomcat:7.0.82 cpe:/a:apache:tomcat:7.0.83 cpe:/a:apache:tomcat:7.0.84 cpe:/a:apache:tomcat:7.0.85 cpe:/a:apache:tomcat:7.0.86 cpe:/a:apache:tomcat:7.0.87 cpe:/a:apache:tomcat:7.0.88 cpe:/a:apache:tomcat:7.0.89 cpe:/a:apache:tomcat:7.0.90 cpe:/a:apache:tomcat:7.0.91 cpe:/a:apache:tomcat:7.0.92 cpe:/a:apache:tomcat:7.0.93 cpe:/a:apache:tomcat:8.5.0 cpe:/a:apache:tomcat:8.5.1 cpe:/a:apache:tomcat:8.5.2 cpe:/a:apache:tomcat:8.5.3 cpe:/a:apache:tomcat:8.5.4 cpe:/a:apache:tomcat:8.5.5 cpe:/a:apache:tomcat:8.5.6 cpe:/a:apache:tomcat:8.5.7 cpe:/a:apache:tomcat:8.5.8 cpe:/a:apache:tomcat:8.5.9 cpe:/a:apache:tomcat:8.5.10 cpe:/a:apache:tomcat:8.5.11 cpe:/a:apache:tomcat:8.5.12 cpe:/a:apache:tomcat:8.5.13 cpe:/a:apache:tomcat:8.5.14 cpe:/a:apache:tomcat:8.5.15 cpe:/a:apache:tomcat:8.5.16 cpe:/a:apache:tomcat:8.5.17 cpe:/a:apache:tomcat:8.5.18 cpe:/a:apache:tomcat:8.5.19 cpe:/a:apache:tomcat:8.5.20 cpe:/a:apache:tomcat:8.5.21 cpe:/a:apache:tomcat:8.5.22 cpe:/a:apache:tomcat:8.5.23 cpe:/a:apache:tomcat:8.5.24 cpe:/a:apache:tomcat:8.5.25 cpe:/a:apache:tomcat:8.5.26 cpe:/a:apache:tomcat:8.5.27 cpe:/a:apache:tomcat:8.5.28 cpe:/a:apache:tomcat:8.5.29 cpe:/a:apache:tomcat:8.5.30 cpe:/a:apache:tomcat:8.5.31 cpe:/a:apache:tomcat:8.5.32 cpe:/a:apache:tomcat:8.5.33 cpe:/a:apache:tomcat:8.5.34 cpe:/a:apache:tomcat:8.5.35 cpe:/a:apache:tomcat:8.5.36 cpe:/a:apache:tomcat:8.5.37 cpe:/a:apache:tomcat:8.5.38 cpe:/a:apache:tomcat:8.5.39 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/a:apache:tomcat:9.0.0:m10 cpe:/a:apache:tomcat:9.0.0:m11 cpe:/a:apache:tomcat:9.0.0:m12 cpe:/a:apache:tomcat:9.0.0:m13 cpe:/a:apache:tomcat:9.0.0:m14 cpe:/a:apache:tomcat:9.0.0:m15 cpe:/a:apache:tomcat:9.0.0:m16 cpe:/a:apache:tomcat:9.0.0:m17 cpe:/a:apache:tomcat:9.0.0:m18 cpe:/a:apache:tomcat:9.0.0:m19 cpe:/a:apache:tomcat:9.0.0:m2 cpe:/a:apache:tomcat:9.0.0:m20 cpe:/a:apache:tomcat:9.0.0:m21 cpe:/a:apache:tomcat:9.0.0:m22 cpe:/a:apache:tomcat:9.0.0:m23 cpe:/a:apache:tomcat:9.0.0:m24 cpe:/a:apache:tomcat:9.0.0:m25 cpe:/a:apache:tomcat:9.0.0:m26 cpe:/a:apache:tomcat:9.0.0:m27 cpe:/a:apache:tomcat:9.0.0:m3 cpe:/a:apache:tomcat:9.0.0:m4 cpe:/a:apache:tomcat:9.0.0:m5 cpe:/a:apache:tomcat:9.0.0:m6 cpe:/a:apache:tomcat:9.0.0:m7 cpe:/a:apache:tomcat:9.0.0:m8 cpe:/a:apache:tomcat:9.0.0:m9 cpe:/a:apache:tomcat:9.0.1 cpe:/a:apache:tomcat:9.0.2 cpe:/a:apache:tomcat:9.0.3 cpe:/a:apache:tomcat:9.0.4 cpe:/a:apache:tomcat:9.0.5 cpe:/a:apache:tomcat:9.0.6 cpe:/a:apache:tomcat:9.0.7 cpe:/a:apache:tomcat:9.0.8 cpe:/a:apache:tomcat:9.0.9 cpe:/a:apache:tomcat:9.0.10 cpe:/a:apache:tomcat:9.0.11 cpe:/a:apache:tomcat:9.0.12 cpe:/a:apache:tomcat:9.0.13 cpe:/a:apache:tomcat:9.0.14 cpe:/a:apache:tomcat:9.0.15 cpe:/a:apache:tomcat:9.0.16 cpe:/a:apache:tomcat:9.0.17

CVE-2019-0221

2019-05-28T18:29:00.563-04:00

2019-06-07T17:29:01.477-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2019:1673 SUSE openSUSE-SU-2019:1808 FULLDISC 20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221 BID 108545 CONFIRM https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E MLIST [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update MLIST [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update FEDORA FEDORA-2019-d66febb5df FEDORA FEDORA-2019-1a3f878d27 CONFIRM https://security.netapp.com/advisory/ntap-20190606-0001/ CONFIRM https://support.f5.com/csp/article/K13184144?utm_source=f5support&utm_medium=RSS UBUNTU USN-4128-1 UBUNTU USN-4128-2 MISC https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/ The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

cpe:/a:apache:activemq:5.0.0 cpe:/a:apache:activemq:5.1.0 cpe:/a:apache:activemq:5.2.0 cpe:/a:apache:activemq:5.3.0 cpe:/a:apache:activemq:5.3.1 cpe:/a:apache:activemq:5.3.2 cpe:/a:apache:activemq:5.4.0 cpe:/a:apache:activemq:5.4.1 cpe:/a:apache:activemq:5.4.2 cpe:/a:apache:activemq:5.4.3 cpe:/a:apache:activemq:5.5.0 cpe:/a:apache:activemq:5.5.1 cpe:/a:apache:activemq:5.6.0 cpe:/a:apache:activemq:5.7.0 cpe:/a:apache:activemq:5.8.0 cpe:/a:apache:activemq:5.9.0 cpe:/a:apache:activemq:5.9.1 cpe:/a:apache:activemq:5.10.0 cpe:/a:apache:activemq:5.10.1 cpe:/a:apache:activemq:5.10.2 cpe:/a:apache:activemq:5.11.0 cpe:/a:apache:activemq:5.11.1 cpe:/a:apache:activemq:5.11.2 cpe:/a:apache:activemq:5.11.3 cpe:/a:apache:activemq:5.12.0 cpe:/a:apache:activemq:5.12.1 cpe:/a:apache:activemq:5.12.2 cpe:/a:apache:activemq:5.12.3 cpe:/a:apache:activemq:5.13.0 cpe:/a:apache:activemq:5.13.1 cpe:/a:apache:activemq:5.13.2 cpe:/a:apache:activemq:5.13.3 cpe:/a:apache:activemq:5.13.4 cpe:/a:apache:activemq:5.13.5 cpe:/a:apache:activemq:5.14.0 cpe:/a:apache:activemq:5.14.1 cpe:/a:apache:activemq:5.14.2 cpe:/a:apache:activemq:5.14.3 cpe:/a:apache:activemq:5.14.4 cpe:/a:apache:activemq:5.14.5 cpe:/a:apache:activemq:5.15.0 cpe:/a:apache:activemq:5.15.1 cpe:/a:apache:activemq:5.15.2 cpe:/a:apache:activemq:5.15.3 cpe:/a:apache:activemq:5.15.4 cpe:/a:apache:activemq:5.15.5 cpe:/a:apache:activemq:5.15.6 cpe:/a:apache:activemq:5.15.7 cpe:/a:apache:activemq:5.15.8 cpe:/a:netapp:e-series_santricity_web_services:-

CVE-2019-0222

2019-03-28T18:29:00.433-04:00

2019-07-23T19:15:35.880-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://activemq.apache.org/security-advisories.data/CVE-2019-0222-announcement.txt MLIST [oss-security] 20190327 [ANNOUNCE] CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown BID 107622 MLIST [activemq-dev] 20190328 Re: Website MLIST [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories MLIST [activemq-dev] 20190327 CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown MLIST [activemq-users] 20190327 CVE-2019-0222 - Apache ActiveMQ: Corrupt MQTT frame can cause broker shutdown MLIST [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ MLIST [activemq-commits] 20190327 svn commit: r1042603 - /websites/production/activemq/content/security-advisories.data/CVE-2019-0222-announcement.txt MLIST [activemq-dev] 20190327 Re: Website CONFIRM https://security.netapp.com/advisory/ntap-20190502-0006/ MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

cpe:/a:apache:qpid:0.9 cpe:/a:apache:qpid:0.10 cpe:/a:apache:qpid:0.11 cpe:/a:apache:qpid:0.12 cpe:/a:apache:qpid:0.13 cpe:/a:apache:qpid:0.14 cpe:/a:apache:qpid:0.15 cpe:/a:apache:qpid:0.16 cpe:/a:apache:qpid:0.17 cpe:/a:apache:qpid:0.18 cpe:/a:apache:qpid:0.19 cpe:/a:apache:qpid:0.20 cpe:/a:apache:qpid:0.22 cpe:/a:redhat:jboss_amq_clients_2:-

CVE-2019-0223

2019-04-23T12:29:00.467-04:00

2019-06-06T16:29:01.853-04:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability BID 108044 REDHAT RHSA-2019:0886 REDHAT RHSA-2019:1398 REDHAT RHSA-2019:1399 REDHAT RHSA-2019:1400 REDHAT RHSA-2019:2777 REDHAT RHSA-2019:2778 REDHAT RHSA-2019:2779 REDHAT RHSA-2019:2780 REDHAT RHSA-2019:2781 REDHAT RHSA-2019:2782 MISC https://issues.apache.org/jira/browse/PROTON-2014?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel MLIST [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability MLIST [qpid-dev] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability MLIST [qpid-dev] 20190423 [jira] [Updated] (PROTON-2014) [CVE-2019-0223] TLS Man in the Middle Vulnerability MLIST qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223 MLIST [announce] 20190423 [SECURITY] CVE-2019-0223: Apache Qpid Proton TLS Man in the Middle Vulnerability While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVE-2019-0224

2019-03-28T17:29:00.243-04:00

2019-05-19T14:29:00.473-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107631 CONFIRM https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0224 MLIST [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures MLIST [jspwiki-dev] 20190326 [CVE-2019-0224] Apache JSPWiki Cross-site scripting vulnerability MLIST [jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.

cpe:/a:apache:jspwiki:2.9.0:incubating cpe:/a:apache:jspwiki:2.9.0:incubating_rc2 cpe:/a:apache:jspwiki:2.9.0:incubating_rc3 cpe:/a:apache:jspwiki:2.9.0:incubating_rc4 cpe:/a:apache:jspwiki:2.9.0:rc1 cpe:/a:apache:jspwiki:2.9.1:incubating_rc1 cpe:/a:apache:jspwiki:2.9.1:incubating_rc2 cpe:/a:apache:jspwiki:2.10.0:- cpe:/a:apache:jspwiki:2.10.0:rc1 cpe:/a:apache:jspwiki:2.10.0:rc2 cpe:/a:apache:jspwiki:2.10.1 cpe:/a:apache:jspwiki:2.10.2 cpe:/a:apache:jspwiki:2.10.3:- cpe:/a:apache:jspwiki:2.10.3:rc1 cpe:/a:apache:jspwiki:2.10.3:rc2 cpe:/a:apache:jspwiki:2.10.4:- cpe:/a:apache:jspwiki:2.10.4:rc1 cpe:/a:apache:jspwiki:2.10.4:rc2 cpe:/a:apache:jspwiki:2.10.4:rc3 cpe:/a:apache:jspwiki:2.10.5 cpe:/a:apache:jspwiki:2.10.5:- cpe:/a:apache:jspwiki:2.10.5:rc1 cpe:/a:apache:jspwiki:2.10.5:rc2 cpe:/a:apache:jspwiki:2.11.0:m1 cpe:/a:apache:jspwiki:2.11.0:m1-rc1 cpe:/a:apache:jspwiki:2.11.0:m1-rc2 cpe:/a:apache:jspwiki:2.11.0:m1-rc3 cpe:/a:apache:jspwiki:2.11.0:m1.rc3 cpe:/a:apache:jspwiki:2.11.0:m2 cpe:/a:apache:jspwiki:2.11.0:m2-rc1 cpe:/a:apache:jspwiki:2.11.0:m3 cpe:/a:apache:jspwiki:2.11.0:m3-rc1 cpe:/a:apache:jspwiki:2.11.0:m3-rc2 cpe:/a:apache:jspwiki:2.11.0:m4 cpe:/a:apache:jspwiki:2.11.0:m4-rc1 cpe:/a:apache:jspwiki:2.11.0:m4-rc2 cpe:/a:apache:jspwiki:2.11.0:milestone1 cpe:/a:apache:jspwiki:2.11.0:milestone1-rc1 cpe:/a:apache:jspwiki:2.11.0:milestone1-rc2 cpe:/a:apache:jspwiki:2.11.0:milestone1-rc3 cpe:/a:apache:jspwiki:2.11.0:milestone2 cpe:/a:apache:jspwiki:2.11.0:milestone2-rc1

CVE-2019-0225

2019-03-28T18:29:00.683-04:00

2019-05-19T14:29:00.757-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov MLIST [oss-security] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure BID 107627 CONFIRM https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225 MLIST [announce] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure MLIST [jspwiki-user] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure MLIST [jspwiki-dev] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure MLIST [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures MLIST [jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.

CVE-2019-0226

2019-05-09T10:29:00.243-04:00

2019-05-10T08:26:56.883-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-05-09T11:23:40.087-04:00

MLIST [karaf-dev] 20190506 [SECURITY] New security advisory for CVE-2019-0226 released for Apache Karaf Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.

cpe:/a:apache:axis:1.4

CVE-2019-0227

2019-05-01T17:29:00.643-04:00

2019-05-03T14:04:41.190-04:00

5.4

ADJACENT_NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-02T10:10:18.660-04:00

MISC https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/ A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

cpe:/a:apache:pdfbox:2.0.14

CVE-2019-0228

2019-04-17T11:29:00.703-04:00

2019-07-08T07:15:09.703-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79@%3Cusers.pdfbox.apache.org%3E MLIST [tika-commits] 20190802 svn commit: r1864252 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ... MLIST [james-server-dev] 20190708 [jira] [Created] (JAMES-2819) Upgrade pdfbox following CVE-2019-0228 MLIST [tika-commits] 20190802 svn commit: r1864251 [1/17] - in /tika/site: publish/ publish/1.10/ publish/1.11/ publish/1.12/ publish/1.13/ publish/1.14/ publish/1.15/ publish/1.16/ publish/1.17/ publish/1.18/ publish/1.19.1/ publish/1.19/ publish/1.20/ publish/1.21/ publish/1.22/ ... FEDORA FEDORA-2019-6fa01d12b4 FEDORA FEDORA-2019-9e91afa2be Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

cpe:/a:apache:airflow:1.10.2

CVE-2019-0229

2019-04-10T16:29:01.117-04:00

2019-04-11T13:29:01.210-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20190410 CVE-2019-0216, CVE-2019-0229 vulnerabilities affecting Apache Airflow <= 1.10.2 webserver component BID 107869 MISC https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

cpe:/a:apache:mina:2.0.20 cpe:/a:apache:mina:2.1.1

CVE-2019-0231

2019-10-01T16:15:11.010-04:00

2019-10-08T13:47:22.907-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-07T08:34:43.357-04:00

MISC http://mina.apache.org/mina-project/index.html#mina-211-mina-2021-released-posted-on-april-14-2019 Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.5:beta cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.51 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:7.0.55 cpe:/a:apache:tomcat:7.0.56 cpe:/a:apache:tomcat:7.0.57 cpe:/a:apache:tomcat:7.0.58 cpe:/a:apache:tomcat:7.0.59 cpe:/a:apache:tomcat:7.0.60 cpe:/a:apache:tomcat:7.0.61 cpe:/a:apache:tomcat:7.0.62 cpe:/a:apache:tomcat:7.0.63 cpe:/a:apache:tomcat:7.0.64 cpe:/a:apache:tomcat:7.0.65 cpe:/a:apache:tomcat:7.0.66 cpe:/a:apache:tomcat:7.0.67 cpe:/a:apache:tomcat:7.0.68 cpe:/a:apache:tomcat:7.0.69 cpe:/a:apache:tomcat:7.0.70 cpe:/a:apache:tomcat:7.0.71 cpe:/a:apache:tomcat:7.0.72 cpe:/a:apache:tomcat:7.0.73 cpe:/a:apache:tomcat:7.0.74 cpe:/a:apache:tomcat:7.0.75 cpe:/a:apache:tomcat:7.0.76 cpe:/a:apache:tomcat:7.0.77 cpe:/a:apache:tomcat:7.0.78 cpe:/a:apache:tomcat:7.0.79 cpe:/a:apache:tomcat:7.0.80 cpe:/a:apache:tomcat:7.0.81 cpe:/a:apache:tomcat:7.0.82 cpe:/a:apache:tomcat:7.0.83 cpe:/a:apache:tomcat:7.0.84 cpe:/a:apache:tomcat:7.0.85 cpe:/a:apache:tomcat:7.0.86 cpe:/a:apache:tomcat:7.0.87 cpe:/a:apache:tomcat:7.0.88 cpe:/a:apache:tomcat:7.0.89 cpe:/a:apache:tomcat:7.0.90 cpe:/a:apache:tomcat:7.0.91 cpe:/a:apache:tomcat:7.0.92 cpe:/a:apache:tomcat:7.0.93 cpe:/a:apache:tomcat:8.5.0 cpe:/a:apache:tomcat:8.5.1 cpe:/a:apache:tomcat:8.5.2 cpe:/a:apache:tomcat:8.5.3 cpe:/a:apache:tomcat:8.5.4 cpe:/a:apache:tomcat:8.5.5 cpe:/a:apache:tomcat:8.5.6 cpe:/a:apache:tomcat:8.5.7 cpe:/a:apache:tomcat:8.5.8 cpe:/a:apache:tomcat:8.5.9 cpe:/a:apache:tomcat:8.5.10 cpe:/a:apache:tomcat:8.5.11 cpe:/a:apache:tomcat:8.5.12 cpe:/a:apache:tomcat:8.5.13 cpe:/a:apache:tomcat:8.5.14 cpe:/a:apache:tomcat:8.5.15 cpe:/a:apache:tomcat:8.5.16 cpe:/a:apache:tomcat:8.5.17 cpe:/a:apache:tomcat:8.5.18 cpe:/a:apache:tomcat:8.5.19 cpe:/a:apache:tomcat:8.5.20 cpe:/a:apache:tomcat:8.5.21 cpe:/a:apache:tomcat:8.5.22 cpe:/a:apache:tomcat:8.5.23 cpe:/a:apache:tomcat:8.5.24 cpe:/a:apache:tomcat:8.5.25 cpe:/a:apache:tomcat:8.5.26 cpe:/a:apache:tomcat:8.5.27 cpe:/a:apache:tomcat:8.5.28 cpe:/a:apache:tomcat:8.5.29 cpe:/a:apache:tomcat:8.5.30 cpe:/a:apache:tomcat:8.5.31 cpe:/a:apache:tomcat:8.5.32 cpe:/a:apache:tomcat:8.5.33 cpe:/a:apache:tomcat:8.5.34 cpe:/a:apache:tomcat:8.5.35 cpe:/a:apache:tomcat:8.5.36 cpe:/a:apache:tomcat:8.5.37 cpe:/a:apache:tomcat:8.5.38 cpe:/a:apache:tomcat:8.5.39 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/a:apache:tomcat:9.0.0:m10 cpe:/a:apache:tomcat:9.0.0:m11 cpe:/a:apache:tomcat:9.0.0:m12 cpe:/a:apache:tomcat:9.0.0:m13 cpe:/a:apache:tomcat:9.0.0:m14 cpe:/a:apache:tomcat:9.0.0:m15 cpe:/a:apache:tomcat:9.0.0:m16 cpe:/a:apache:tomcat:9.0.0:m17 cpe:/a:apache:tomcat:9.0.0:m18 cpe:/a:apache:tomcat:9.0.0:m19 cpe:/a:apache:tomcat:9.0.0:m2 cpe:/a:apache:tomcat:9.0.0:m20 cpe:/a:apache:tomcat:9.0.0:m21 cpe:/a:apache:tomcat:9.0.0:m22 cpe:/a:apache:tomcat:9.0.0:m23 cpe:/a:apache:tomcat:9.0.0:m24 cpe:/a:apache:tomcat:9.0.0:m25 cpe:/a:apache:tomcat:9.0.0:m26 cpe:/a:apache:tomcat:9.0.0:m3 cpe:/a:apache:tomcat:9.0.0:m4 cpe:/a:apache:tomcat:9.0.0:m5 cpe:/a:apache:tomcat:9.0.0:m6 cpe:/a:apache:tomcat:9.0.0:m7 cpe:/a:apache:tomcat:9.0.0:m8 cpe:/a:apache:tomcat:9.0.0:m9 cpe:/a:apache:tomcat:9.0.1 cpe:/a:apache:tomcat:9.0.2 cpe:/a:apache:tomcat:9.0.3 cpe:/a:apache:tomcat:9.0.4 cpe:/a:apache:tomcat:9.0.5 cpe:/a:apache:tomcat:9.0.6 cpe:/a:apache:tomcat:9.0.7 cpe:/a:apache:tomcat:9.0.8 cpe:/a:apache:tomcat:9.0.9 cpe:/a:apache:tomcat:9.0.10 cpe:/a:apache:tomcat:9.0.11 cpe:/a:apache:tomcat:9.0.12 cpe:/a:apache:tomcat:9.0.13 cpe:/a:apache:tomcat:9.0.14 cpe:/a:apache:tomcat:9.0.15 cpe:/a:apache:tomcat:9.0.16 cpe:/a:apache:tomcat:9.0.17

CVE-2019-0232

2019-04-15T11:29:00.420-04:00

2019-06-01T05:29:00.253-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html FULLDISC 20190504 RCE in CGI Servlet - Apache Tomcat on Windows - CVE-2019-0232 BID 107906 REDHAT RHSA-2019:1712 MISC https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/ MISC https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html MLIST [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [ofbiz-commits] 20190415 svn commit: r1857588 - in /ofbiz: ofbiz-framework/branches/release17.12/build.gradle ofbiz-plugins/branches/release17.12/example/build.gradle MLIST [tomcat-users] 20190410 [SECURITY] CVE-2019-0232 Apache Tomcat Remote Code Execution on Windows MLIST [ofbiz-commits] 20190415 svn commit: r1857587 - in /ofbiz: ofbiz-framework/branches/release18.12/build.gradle ofbiz-plugins/branches/release18.12/example/build.gradle MLIST [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [ofbiz-notifications] 20190415 [jira] [Closed] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232 MLIST [ofbiz-commits] 20190415 svn commit: r1857586 - in /ofbiz: ofbiz-framework/trunk/build.gradle ofbiz-plugins/trunk/example/build.gradle MLIST [ofbiz-notifications] 20190415 [jira] [Commented] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232 MLIST [tomcat-dev] 20190421 svn commit: r1857901 - in /tomcat/site/trunk: docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml CONFIRM https://security.netapp.com/advisory/ntap-20190419-0001/ MISC. https://tools.cisco.com/security/center/viewAlert.x?alertId=60004&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Apache%20Tomcat%20CGI%20Servlet%20Arbitrary%20Code%20Execution%20Vulnerability&vs_k=1 MISC https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/ CONFIRM https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html CONFIRM https://www.synology.com/security/advisory/Synology_SA_19_17 MISC https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/ When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

cpe:/a:apache:roller:5.2.0 cpe:/a:apache:roller:5.2.1 cpe:/a:apache:roller:5.2.2

CVE-2019-0234

2019-07-15T18:15:12.133-04:00

2019-07-18T09:25:25.560-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-16T14:56:15.497-04:00

CONFIRM https://lists.apache.org/thread.html/26cdef3fa8a8fa7fcbb99320aa860836ead124b414c654a4d12674cf@%3Cdev.roller.apache.org%3E A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of Roller, which is now Roller 5.2.3.

cpe:/a:sap:hybris:5.0.0 cpe:/a:sap:hybris:5.0.0.3 cpe:/a:sap:hybris:5.0.3 cpe:/a:sap:hybris:5.0.3.3 cpe:/a:sap:hybris:5.0.4 cpe:/a:sap:hybris:5.0.4.4 cpe:/a:sap:hybris:5.0.4.10 cpe:/a:sap:hybris:5.0.4.11 cpe:/a:sap:hybris:5.1.0 cpe:/a:sap:hybris:5.1.0.1 cpe:/a:sap:hybris:5.1.0.10 cpe:/a:sap:hybris:5.1.1 cpe:/a:sap:hybris:5.1.1.2 cpe:/a:sap:hybris:5.1.1.11 cpe:/a:sap:hybris:5.1.1.12 cpe:/a:sap:hybris:5.2.0 cpe:/a:sap:hybris:5.2.0.3 cpe:/a:sap:hybris:5.2.0.10 cpe:/a:sap:hybris:5.2.0.12 cpe:/a:sap:hybris:5.2.0.13 cpe:/a:sap:hybris:5.3.0 cpe:/a:sap:hybris:5.3.0.1 cpe:/a:sap:hybris:5.3.0.9 cpe:/a:sap:hybris:5.3.0.10 cpe:/a:sap:hybris:5.3.0.11 cpe:/a:sap:hybris:5.4.0 cpe:/a:sap:hybris:5.4.0.9 cpe:/a:sap:hybris:5.4.0.10 cpe:/a:sap:hybris:5.4.0.11 cpe:/a:sap:hybris:5.5.0 cpe:/a:sap:hybris:5.5.0.8 cpe:/a:sap:hybris:5.5.0.9 cpe:/a:sap:hybris:5.5.0.10 cpe:/a:sap:hybris:5.5.1 cpe:/a:sap:hybris:5.5.1.9 cpe:/a:sap:hybris:5.5.1.10 cpe:/a:sap:hybris:5.5.1.11 cpe:/a:sap:hybris:5.6.0 cpe:/a:sap:hybris:5.6.0.7 cpe:/a:sap:hybris:5.6.0.8 cpe:/a:sap:hybris:5.6.0.10 cpe:/a:sap:hybris:5.6.0.11 cpe:/a:sap:hybris:5.7.0 cpe:/a:sap:hybris:5.7.0.8 cpe:/a:sap:hybris:5.7.0.9 cpe:/a:sap:hybris:5.7.0.14 cpe:/a:sap:hybris:5.7.0.15 cpe:/a:sap:hybris:6.0 cpe:/a:sap:hybris:6.1 cpe:/a:sap:hybris:6.2 cpe:/a:sap:hybris:6.3 cpe:/a:sap:hybris:6.4 cpe:/a:sap:hybris:6.5 cpe:/a:sap:hybris:6.6

CVE-2019-0238

2019-01-08T15:29:00.437-05:00

2019-01-17T13:21:28.940-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-16T12:59:53.367-05:00

BID 106462 MISC https://launchpad.support.sap.com/#/notes/2697573 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2019-0240

2019-01-08T15:29:00.517-05:00

2019-01-17T10:00:15.017-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-17T08:14:29.823-05:00

BID 106470 MISC https://launchpad.support.sap.com/#/notes/2724059 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it.

cpe:/a:sap:agentry_sdk:7.0 cpe:/a:sap:agentry_sdk:7.1 cpe:/a:sap:work_manager:-

CVE-2019-0241

2019-01-08T15:29:00.597-05:00

2019-01-30T12:19:13.613-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-17T08:01:04.777-05:00

BID 106461 MISC https://launchpad.support.sap.com/#/notes/2725538 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

cpe:/a:sap:bw%2f4hana:1.0:sp08

CVE-2019-0243

2019-01-08T15:29:00.657-05:00

2019-01-29T15:31:27.943-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-01-17T07:18:15.923-05:00

BID 106467 MISC https://launchpad.support.sap.com/#/notes/2727623 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

cpe:/a:sap:customer_relationship_management_webclient_ui:7.31 cpe:/a:sap:customer_relationship_management_webclient_ui:7.46 cpe:/a:sap:customer_relationship_management_webclient_ui:7.47 cpe:/a:sap:customer_relationship_management_webclient_ui:7.48 cpe:/a:sap:customer_relationship_management_webclient_ui:8.00 cpe:/a:sap:customer_relationship_management_webclient_ui:8.01 cpe:/a:sap:s4fnd:1.02 cpe:/a:sap:sapscore:1.12

CVE-2019-0244

2019-01-08T15:29:00.737-05:00

2019-01-17T10:21:09.920-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-16T13:16:23.983-05:00

BID 106473 MISC https://launchpad.support.sap.com/#/notes/2588763 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2019-0245

2019-01-08T15:29:00.783-05:00

2019-01-17T10:21:25.013-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-16T13:09:39.720-05:00

BID 106468 MISC https://launchpad.support.sap.com/#/notes/2588763 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2019-0246

2019-01-08T15:29:00.847-05:00

2019-01-17T13:34:37.970-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-16T12:53:28.237-05:00

BID 106463 MISC https://launchpad.support.sap.com/#/notes/2696233 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.

CVE-2019-0247

2019-01-08T15:29:00.907-05:00

2019-01-17T13:35:09.767-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-16T12:27:34.930-05:00

MISC https://launchpad.support.sap.com/#/notes/2696233 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

cpe:/a:sap:netweaver:7.5 cpe:/a:sap:netweaver:7.51 cpe:/a:sap:netweaver:7.52 cpe:/a:sap:netweaver:7.53 cpe:/a:sap:sap_basis:7.5

CVE-2019-0248

2019-01-08T15:29:00.970-05:00

2019-02-01T13:50:03.090-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-16T14:07:58.753-05:00

BID 106471 MISC https://launchpad.support.sap.com/#/notes/2723142 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:landscape_management:3.0

CVE-2019-0249

2019-01-08T15:29:01.047-05:00

2019-01-17T13:57:05.317-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-16T12:08:18.417-05:00

BID 106464 MISC https://launchpad.support.sap.com/#/notes/2727624 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985 Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:businessobjects:4.2 cpe:/a:sap:businessobjects:4.3

CVE-2019-0251

2019-02-15T13:29:00.287-05:00

2019-02-19T16:07:59.850-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-15T23:30:42.003-05:00

BID 106993 MISC https://launchpad.support.sap.com/#/notes/2638175 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2019-0254

2019-02-15T13:29:00.430-05:00

2019-02-20T10:36:11.677-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-19T12:26:09.343-05:00

BID 107004 MISC https://launchpad.support.sap.com/#/notes/2706798 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.73 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.74 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.75. cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.74 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.73 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.74

CVE-2019-0255

2019-02-15T13:29:00.600-05:00

2019-02-22T14:58:09.047-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-22T13:05:04.340-05:00

BID 106987 MISC https://launchpad.support.sap.com/#/notes/2723570 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.

cpe:/a:sap:business_one:1.2.12::~~~android~~

CVE-2019-0256

2019-02-15T13:29:00.867-05:00

2019-02-26T15:03:20.777-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-26T14:39:19.883-05:00

BID 106995 MISC https://launchpad.support.sap.com/#/notes/2723878 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:netweaver_abap:7.0 cpe:/a:sap:netweaver_abap:7.02:sp6 cpe:/a:sap:netweaver_abap:7.30 cpe:/a:sap:netweaver_abap:7.31 cpe:/a:sap:netweaver_abap:7.40

CVE-2019-0257

2019-02-15T13:29:01.037-05:00

2019-02-21T14:34:29.090-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-02-19T14:35:11.537-05:00

BID 106999 MISC https://launchpad.support.sap.com/#/notes/2728839 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

cpe:/a:sap:disclosure_management:10.01

CVE-2019-0258

2019-02-15T13:29:01.180-05:00

2019-02-20T11:10:53.430-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-02-15T23:32:49.270-05:00

BID 106969 MISC https://launchpad.support.sap.com/#/notes/2724014 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

cpe:/a:sap:businessobjects:4.2 cpe:/a:sap:businessobjects:4.3

CVE-2019-0259

2019-02-15T13:29:01.367-05:00

2019-02-20T10:29:34.100-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-15T23:06:58.567-05:00

BID 106997 MISC https://launchpad.support.sap.com/#/notes/2727564 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper file format validation.

cpe:/a:sap:landscape_management:3.0

CVE-2019-0261

2019-02-15T13:29:01.587-05:00

2019-02-26T11:29:41.957-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-25T13:31:26.277-05:00

BID 106986 MISC https://launchpad.support.sap.com/#/notes/2742027 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 Under certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authentication checks properly for XS advanced platform and business users. Fixed in 1.0.97 to 1.0.99 (running on SAP HANA 1 or SAP HANA 2 SPS0 (second S stands for stack)).

cpe:/a:sap:businessobjects_bi_platform:4.10 cpe:/a:sap:businessobjects_bi_platform:4.20

CVE-2019-0262

2019-02-15T13:29:01.680-05:00

2019-02-19T16:16:24.693-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-15T23:13:53.420-05:00

BID 106998 MISC https://launchpad.support.sap.com/#/notes/2696714 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.45 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.49 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.53 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.73 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.75. cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.49 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.49 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.73

CVE-2019-0265

2019-02-15T13:29:01.883-05:00

2019-03-13T12:51:23.390-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-03-13T12:22:56.963-04:00

BID 106972 BID 107364 MISC https://launchpad.support.sap.com/#/notes/2729710 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.

cpe:/a:sap:hana_extended_application_services:1.0

CVE-2019-0266

2019-02-15T13:29:02.087-05:00

2019-02-20T10:19:47.793-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-15T23:10:48.307-05:00

BID 106988 MISC https://launchpad.support.sap.com/#/notes/2724713 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthorized access, the risk of leaking information is increased.

cpe:/a:sap:manufacturing_integration_and_intelligence:15.0 cpe:/a:sap:manufacturing_integration_and_intelligence:15.1 cpe:/a:sap:manufacturing_integration_and_intelligence:15.2

CVE-2019-0267

2019-02-15T13:29:02.320-05:00

2019-02-20T10:06:29.593-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-15T23:26:02.543-05:00

BID 106990 MISC https://launchpad.support.sap.com/#/notes/2686535 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0268

2019-03-12T18:29:00.300-04:00

2019-03-13T11:06:51.827-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-03-13T09:55:38.323-04:00

BID 107364 MISC https://launchpad.support.sap.com/#/notes/2689259 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.

cpe:/a:sap:businessobjects_business_intelligence:4.10 cpe:/a:sap:businessobjects_business_intelligence:4.20

CVE-2019-0269

2019-03-12T18:29:00.347-04:00

2019-03-13T10:38:30.660-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-13T09:41:14.460-04:00

BID 107359 MISC https://launchpad.support.sap.com/#/notes/2693962 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.15 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.21 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.22 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.49 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.53 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.73 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.74 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.75 cpe:/a:sap:advanced_business_application_programming_platform_kernel:8.04 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.49 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.73 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.74 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:8.04

CVE-2019-0270

2019-03-12T18:29:00.427-04:00

2019-03-15T12:21:49.360-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-03-13T11:54:10.253-04:00

BID 107377 MISC https://launchpad.support.sap.com/#/notes/2727689 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.

cpe:/a:sap:advanced_business_application_programming_platform:- cpe:/a:sap:sap_kernel:7.21 cpe:/a:sap:sap_kernel:7.22 cpe:/a:sap:sap_kernel:7.45 cpe:/a:sap:sap_kernel:7.49 cpe:/a:sap:sap_kernel:7.53

CVE-2019-0271

2019-03-12T18:29:00.487-04:00

2019-03-19T13:09:36.727-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-03-13T12:35:48.727-04:00

BID 107355 MISC https://launchpad.support.sap.com/#/notes/2736825 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity (XEE) vulnerability. Fixed in Kernel 7.21 or 7.22, that is ABAP Server 7.00 to 7.31 and Kernel 7.45, 7.49 or 7.53, that is ABAP Server 7.40 to 7.52 or ABAP Platform.

cpe:/a:sap:mobile_platform_sdk:3.0

CVE-2019-0274

2019-03-12T18:29:00.537-04:00

2019-03-14T10:51:42.970-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-13T14:00:47.807-04:00

BID 107360 MISC https://launchpad.support.sap.com/#/notes/2753497 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of service). Fixed in versions 3.1 SP03 PL02, SDK 3.1 SP04, or later.

cpe:/a:sap:netweaver_java_application_server:7.20 cpe:/a:sap:netweaver_java_application_server:7.30 cpe:/a:sap:netweaver_java_application_server:7.31 cpe:/a:sap:netweaver_java_application_server:7.40 cpe:/a:sap:netweaver_java_application_server:7.50

CVE-2019-0275

2019-03-12T18:29:00.597-04:00

2019-03-13T21:15:54.127-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-13T17:41:48.880-04:00

BID 107362 MISC https://launchpad.support.sap.com/#/notes/2689925 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting (XSS) vulnerability.

cpe:/a:sap:banking_services_from_sap:9.0 cpe:/a:sap:s%2f4hana_financial_products_subledger:1.0

CVE-2019-0276

2019-03-12T18:29:00.677-04:00

2019-03-13T21:18:20.160-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-03-13T17:29:15.477-04:00

BID 107353 MISC https://launchpad.support.sap.com/#/notes/2754235 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges.

cpe:/a:sap:hana_extended_application_services:1.0

CVE-2019-0277

2019-03-12T18:29:00.737-04:00

2019-03-13T14:16:54.047-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-03-13T13:27:30.523-04:00

BID 107356 MISC https://launchpad.support.sap.com/#/notes/2764283 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080 SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privileges to the SAP space (XML External Entity vulnerability).

cpe:/a:sap:netweaver_process_integration:7.10 cpe:/a:sap:netweaver_process_integration:7.11 cpe:/a:sap:netweaver_process_integration:7.20 cpe:/a:sap:netweaver_process_integration:7.30 cpe:/a:sap:netweaver_process_integration:7.31 cpe:/a:sap:netweaver_process_integration:7.40 cpe:/a:sap:netweaver_process_integration:7.50

CVE-2019-0278

2019-04-10T17:29:01.107-04:00

2019-04-11T16:48:56.650-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-11T16:18:22.343-04:00

CONFIRM https://launchpad.support.sap.com/#/notes/2741201 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure.

cpe:/a:sap:business_application_software_integrated_solution:7.00 cpe:/a:sap:business_application_software_integrated_solution:7.01 cpe:/a:sap:business_application_software_integrated_solution:7.02 cpe:/a:sap:business_application_software_integrated_solution:7.10 cpe:/a:sap:business_application_software_integrated_solution:7.11 cpe:/a:sap:business_application_software_integrated_solution:7.30 cpe:/a:sap:business_application_software_integrated_solution:7.31 cpe:/a:sap:business_application_software_integrated_solution:7.40 cpe:/a:sap:business_application_software_integrated_solution:7.50 cpe:/a:sap:business_application_software_integrated_solution:7.51 cpe:/a:sap:business_application_software_integrated_solution:7.52

CVE-2019-0279

2019-04-10T17:29:01.153-04:00

2019-04-12T08:28:31.093-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-04-12T07:26:22.597-04:00

CONFIRM https://launchpad.support.sap.com/#/notes/2753629 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.

cpe:/a:sap:treasury_and_risk_management:6.0 cpe:/a:sap:treasury_and_risk_management:6.03 cpe:/a:sap:treasury_and_risk_management:6.04 cpe:/a:sap:treasury_and_risk_management:6.05 cpe:/a:sap:treasury_and_risk_management:6.06 cpe:/a:sap:treasury_and_risk_management:6.16 cpe:/a:sap:treasury_and_risk_management:6.17 cpe:/a:sap:treasury_and_risk_management:6.18 cpe:/a:sap:treasury_and_risk_management:8.0

CVE-2019-0280

2019-05-14T17:29:00.450-04:00

2019-05-16T08:37:40.803-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-05-15T18:37:48.680-04:00

MISC https://launchpad.support.sap.com/#/notes/2744937 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

cpe:/a:sap:openui5:1.25.0 cpe:/a:sap:openui5:1.26.0 cpe:/a:sap:openui5:1.26.1 cpe:/a:sap:openui5:1.26.2 cpe:/a:sap:openui5:1.26.3 cpe:/a:sap:openui5:1.26.4 cpe:/a:sap:openui5:1.26.5 cpe:/a:sap:openui5:1.26.6 cpe:/a:sap:openui5:1.26.7 cpe:/a:sap:openui5:1.26.8 cpe:/a:sap:openui5:1.26.9 cpe:/a:sap:openui5:1.26.10 cpe:/a:sap:openui5:1.26.11 cpe:/a:sap:openui5:1.26.12 cpe:/a:sap:openui5:1.26.13 cpe:/a:sap:openui5:1.26.14 cpe:/a:sap:openui5:1.26.15 cpe:/a:sap:openui5:1.26.16 cpe:/a:sap:openui5:1.27.0 cpe:/a:sap:openui5:1.28.0 cpe:/a:sap:openui5:1.28.1 cpe:/a:sap:openui5:1.28.2 cpe:/a:sap:openui5:1.28.3 cpe:/a:sap:openui5:1.28.4 cpe:/a:sap:openui5:1.28.5 cpe:/a:sap:openui5:1.28.6 cpe:/a:sap:openui5:1.28.7 cpe:/a:sap:openui5:1.28.8 cpe:/a:sap:openui5:1.28.9 cpe:/a:sap:openui5:1.28.10 cpe:/a:sap:openui5:1.28.11 cpe:/a:sap:openui5:1.28.12 cpe:/a:sap:openui5:1.28.13 cpe:/a:sap:openui5:1.28.14 cpe:/a:sap:openui5:1.28.15 cpe:/a:sap:openui5:1.28.16 cpe:/a:sap:openui5:1.28.17 cpe:/a:sap:openui5:1.28.18 cpe:/a:sap:openui5:1.28.19 cpe:/a:sap:openui5:1.28.20 cpe:/a:sap:openui5:1.28.21 cpe:/a:sap:openui5:1.28.22 cpe:/a:sap:openui5:1.28.23 cpe:/a:sap:openui5:1.28.24 cpe:/a:sap:openui5:1.28.25 cpe:/a:sap:openui5:1.28.26 cpe:/a:sap:openui5:1.28.27 cpe:/a:sap:openui5:1.28.28 cpe:/a:sap:openui5:1.28.29 cpe:/a:sap:openui5:1.28.30 cpe:/a:sap:openui5:1.28.31 cpe:/a:sap:openui5:1.28.32 cpe:/a:sap:openui5:1.28.33 cpe:/a:sap:openui5:1.28.34 cpe:/a:sap:openui5:1.28.35 cpe:/a:sap:openui5:1.28.36 cpe:/a:sap:openui5:1.28.37 cpe:/a:sap:openui5:1.28.38 cpe:/a:sap:openui5:1.28.39 cpe:/a:sap:openui5:1.28.40 cpe:/a:sap:openui5:1.28.41 cpe:/a:sap:openui5:1.28.42 cpe:/a:sap:openui5:1.28.43 cpe:/a:sap:openui5:1.28.44 cpe:/a:sap:openui5:1.28.45 cpe:/a:sap:openui5:1.28.46 cpe:/a:sap:openui5:1.28.47 cpe:/a:sap:openui5:1.28.48 cpe:/a:sap:openui5:1.28.49 cpe:/a:sap:openui5:1.28.50 cpe:/a:sap:openui5:1.28.51 cpe:/a:sap:openui5:1.28.52 cpe:/a:sap:openui5:1.29.0 cpe:/a:sap:openui5:1.30.0 cpe:/a:sap:openui5:1.30.1 cpe:/a:sap:openui5:1.30.2 cpe:/a:sap:openui5:1.30.3 cpe:/a:sap:openui5:1.30.4 cpe:/a:sap:openui5:1.30.5 cpe:/a:sap:openui5:1.30.6 cpe:/a:sap:openui5:1.30.7 cpe:/a:sap:openui5:1.30.8 cpe:/a:sap:openui5:1.30.9 cpe:/a:sap:openui5:1.30.10 cpe:/a:sap:openui5:1.30.11 cpe:/a:sap:openui5:1.32.0 cpe:/a:sap:openui5:1.32.1 cpe:/a:sap:openui5:1.32.2 cpe:/a:sap:openui5:1.32.3 cpe:/a:sap:openui5:1.32.4 cpe:/a:sap:openui5:1.32.5 cpe:/a:sap:openui5:1.32.6 cpe:/a:sap:openui5:1.32.7 cpe:/a:sap:openui5:1.32.8 cpe:/a:sap:openui5:1.32.9 cpe:/a:sap:openui5:1.32.10 cpe:/a:sap:openui5:1.32.11 cpe:/a:sap:openui5:1.32.12 cpe:/a:sap:openui5:1.32.13 cpe:/a:sap:openui5:1.32.14 cpe:/a:sap:openui5:1.32.15 cpe:/a:sap:openui5:1.32.16 cpe:/a:sap:openui5:1.32.17 cpe:/a:sap:openui5:1.34.0 cpe:/a:sap:openui5:1.34.1 cpe:/a:sap:openui5:1.34.2 cpe:/a:sap:openui5:1.34.3 cpe:/a:sap:openui5:1.34.4 cpe:/a:sap:openui5:1.34.5 cpe:/a:sap:openui5:1.34.6 cpe:/a:sap:openui5:1.34.7 cpe:/a:sap:openui5:1.34.8 cpe:/a:sap:openui5:1.34.9 cpe:/a:sap:openui5:1.34.10 cpe:/a:sap:openui5:1.34.11 cpe:/a:sap:openui5:1.34.12 cpe:/a:sap:openui5:1.36.0 cpe:/a:sap:openui5:1.36.1 cpe:/a:sap:openui5:1.36.2 cpe:/a:sap:openui5:1.36.3 cpe:/a:sap:openui5:1.36.4 cpe:/a:sap:openui5:1.36.5 cpe:/a:sap:openui5:1.36.6 cpe:/a:sap:openui5:1.36.7 cpe:/a:sap:openui5:1.36.8 cpe:/a:sap:openui5:1.36.9 cpe:/a:sap:openui5:1.36.10 cpe:/a:sap:openui5:1.36.11 cpe:/a:sap:openui5:1.36.12 cpe:/a:sap:openui5:1.36.13 cpe:/a:sap:openui5:1.36.14 cpe:/a:sap:openui5:1.36.15 cpe:/a:sap:openui5:1.36.16 cpe:/a:sap:openui5:1.38.0 cpe:/a:sap:openui5:1.38.1 cpe:/a:sap:openui5:1.38.2 cpe:/a:sap:openui5:1.38.3 cpe:/a:sap:openui5:1.38.4 cpe:/a:sap:openui5:1.38.5 cpe:/a:sap:openui5:1.38.6 cpe:/a:sap:openui5:1.38.7 cpe:/a:sap:openui5:1.38.8 cpe:/a:sap:openui5:1.38.9 cpe:/a:sap:openui5:1.38.10 cpe:/a:sap:openui5:1.38.11 cpe:/a:sap:openui5:1.38.12 cpe:/a:sap:openui5:1.38.13 cpe:/a:sap:openui5:1.38.14 cpe:/a:sap:openui5:1.38.15 cpe:/a:sap:openui5:1.38.16 cpe:/a:sap:openui5:1.38.17 cpe:/a:sap:openui5:1.38.18 cpe:/a:sap:openui5:1.38.19 cpe:/a:sap:openui5:1.38.20 cpe:/a:sap:openui5:1.38.21 cpe:/a:sap:openui5:1.38.22 cpe:/a:sap:openui5:1.38.23 cpe:/a:sap:openui5:1.38.24 cpe:/a:sap:openui5:1.38.25 cpe:/a:sap:openui5:1.38.26 cpe:/a:sap:openui5:1.38.27 cpe:/a:sap:openui5:1.38.28 cpe:/a:sap:openui5:1.38.29 cpe:/a:sap:openui5:1.38.30 cpe:/a:sap:openui5:1.38.31 cpe:/a:sap:openui5:1.38.32 cpe:/a:sap:openui5:1.38.33 cpe:/a:sap:openui5:1.38.34 cpe:/a:sap:openui5:1.38.35 cpe:/a:sap:openui5:1.38.36 cpe:/a:sap:openui5:1.38.37 cpe:/a:sap:openui5:1.38.38 cpe:/a:sap:openui5:1.40.0 cpe:/a:sap:openui5:1.40.1 cpe:/a:sap:openui5:1.40.2 cpe:/a:sap:openui5:1.40.3 cpe:/a:sap:openui5:1.40.4 cpe:/a:sap:openui5:1.40.5 cpe:/a:sap:openui5:1.40.6 cpe:/a:sap:openui5:1.40.7 cpe:/a:sap:openui5:1.40.8 cpe:/a:sap:openui5:1.40.9 cpe:/a:sap:openui5:1.40.10 cpe:/a:sap:openui5:1.40.11 cpe:/a:sap:openui5:1.40.12 cpe:/a:sap:openui5:1.40.13 cpe:/a:sap:openui5:1.40.14 cpe:/a:sap:openui5:1.40.15 cpe:/a:sap:openui5:1.40.16 cpe:/a:sap:openui5:1.40.17 cpe:/a:sap:openui5:1.40.18 cpe:/a:sap:openui5:1.42.0 cpe:/a:sap:openui5:1.42.1 cpe:/a:sap:openui5:1.42.2 cpe:/a:sap:openui5:1.42.3 cpe:/a:sap:openui5:1.42.4 cpe:/a:sap:openui5:1.42.5 cpe:/a:sap:openui5:1.42.6 cpe:/a:sap:openui5:1.42.7 cpe:/a:sap:openui5:1.42.8 cpe:/a:sap:openui5:1.42.9 cpe:/a:sap:openui5:1.44.0 cpe:/a:sap:openui5:1.44.1 cpe:/a:sap:openui5:1.44.2 cpe:/a:sap:openui5:1.44.3 cpe:/a:sap:openui5:1.44.4 cpe:/a:sap:openui5:1.44.5 cpe:/a:sap:openui5:1.44.6 cpe:/a:sap:openui5:1.44.7 cpe:/a:sap:openui5:1.44.8 cpe:/a:sap:openui5:1.44.9 cpe:/a:sap:openui5:1.44.10 cpe:/a:sap:openui5:1.44.11 cpe:/a:sap:openui5:1.44.12 cpe:/a:sap:openui5:1.44.13 cpe:/a:sap:openui5:1.44.14 cpe:/a:sap:openui5:1.44.15 cpe:/a:sap:openui5:1.44.16 cpe:/a:sap:openui5:1.44.17 cpe:/a:sap:openui5:1.44.18 cpe:/a:sap:openui5:1.44.19 cpe:/a:sap:openui5:1.44.20 cpe:/a:sap:openui5:1.44.21 cpe:/a:sap:openui5:1.44.22 cpe:/a:sap:openui5:1.44.23 cpe:/a:sap:openui5:1.44.24 cpe:/a:sap:openui5:1.44.25 cpe:/a:sap:openui5:1.44.26 cpe:/a:sap:openui5:1.44.27 cpe:/a:sap:openui5:1.44.28 cpe:/a:sap:openui5:1.44.29 cpe:/a:sap:openui5:1.44.30 cpe:/a:sap:openui5:1.44.31 cpe:/a:sap:openui5:1.44.32 cpe:/a:sap:openui5:1.44.33 cpe:/a:sap:openui5:1.44.34 cpe:/a:sap:openui5:1.44.35 cpe:/a:sap:openui5:1.44.36 cpe:/a:sap:openui5:1.44.37 cpe:/a:sap:openui5:1.44.38 cpe:/a:sap:openui5:1.50.0 cpe:/a:sap:openui5:1.50.1 cpe:/a:sap:openui5:1.50.2 cpe:/a:sap:openui5:1.50.3 cpe:/a:sap:openui5:1.50.4 cpe:/a:sap:openui5:1.50.5 cpe:/a:sap:openui5:1.50.6 cpe:/a:sap:openui5:1.50.7 cpe:/a:sap:openui5:1.50.8 cpe:/a:sap:openui5:1.50.9 cpe:/a:sap:openui5:1.52.0 cpe:/a:sap:openui5:1.52.1 cpe:/a:sap:openui5:1.52.2 cpe:/a:sap:openui5:1.52.3 cpe:/a:sap:openui5:1.52.4 cpe:/a:sap:openui5:1.52.5 cpe:/a:sap:openui5:1.52.6 cpe:/a:sap:openui5:1.52.7 cpe:/a:sap:openui5:1.52.8 cpe:/a:sap:openui5:1.52.9 cpe:/a:sap:openui5:1.52.10 cpe:/a:sap:openui5:1.52.11 cpe:/a:sap:openui5:1.52.12 cpe:/a:sap:openui5:1.52.13 cpe:/a:sap:openui5:1.52.14 cpe:/a:sap:openui5:1.52.15 cpe:/a:sap:openui5:1.52.16 cpe:/a:sap:openui5:1.52.17 cpe:/a:sap:openui5:1.52.18 cpe:/a:sap:openui5:1.52.19 cpe:/a:sap:openui5:1.52.20 cpe:/a:sap:openui5:1.52.21 cpe:/a:sap:openui5:1.52.22 cpe:/a:sap:openui5:1.52.23 cpe:/a:sap:openui5:1.52.24 cpe:/a:sap:openui5:1.60.0 cpe:/a:sap:openui5:1.60.1 cpe:/a:sap:openui5:1.60.2 cpe:/a:sap:openui5:1.60.3 cpe:/a:sap:openui5:1.60.4 cpe:/a:sap:openui5:1.60.5

CVE-2019-0281

2019-07-10T15:15:10.080-04:00

2019-07-18T08:59:09.120-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T13:15:46.847-04:00

BID 109077 MISC https://launchpad.support.sap.com/#/notes/2756539 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:netweaver_process_integration:7.10 cpe:/a:sap:netweaver_process_integration:7.11 cpe:/a:sap:netweaver_process_integration:7.30 cpe:/a:sap:netweaver_process_integration:7.31 cpe:/a:sap:netweaver_process_integration:7.40 cpe:/a:sap:netweaver_process_integration:7.50

CVE-2019-0282

2019-04-10T17:29:01.217-04:00

2019-04-11T16:29:29.543-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-11T16:17:13.623-04:00

CONFIRM https://launchpad.support.sap.com/#/notes/2742758 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker.

CVE-2019-0283

2019-04-10T17:29:01.277-04:00

2019-04-11T16:10:58.907-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-11T15:58:44.260-04:00

CONFIRM https://launchpad.support.sap.com/#/notes/2747683 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.

cpe:/a:sap:hana:1.0 cpe:/a:sap:hana:2.0

CVE-2019-0284

2019-04-10T17:29:01.357-04:00

2019-04-11T15:49:35.310-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-04-11T15:42:07.443-04:00

CONFIRM https://launchpad.support.sap.com/#/notes/2772376 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files and even send local files.

cpe:/a:sap:crystal_reports:2010::~~~visual_studio~~

CVE-2019-0285

2019-04-10T17:29:01.417-04:00

2019-07-01T14:15:10.567-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153471/SAP-Crystal-Reports-Information-Disclosure.html CONFIRM https://launchpad.support.sap.com/#/notes/2687663 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.

cpe:/a:sap:businessobjects:4.2 cpe:/a:sap:businessobjects:4.3

CVE-2019-0287

2019-05-14T17:29:00.527-04:00

2019-05-15T20:29:30.417-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-15T17:25:47.813-04:00

BID 108316 MISC https://launchpad.support.sap.com/#/notes/2737278 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:businessobjects:4.2 cpe:/a:sap:businessobjects:4.3

CVE-2019-0289

2019-05-14T17:29:00.637-04:00

2019-05-15T20:27:19.940-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-15T17:23:54.407-04:00

MISC https://launchpad.support.sap.com/#/notes/2738796 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:solution_manager:7.2

CVE-2019-0291

2019-05-14T17:29:00.717-04:00

2019-05-15T20:20:42.387-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-15T18:33:47.377-04:00

BID 108313 MISC https://launchpad.support.sap.com/#/notes/2748699 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:sap_solution_manager_system:2008_1_700 cpe:/a:sap:sap_solution_manager_system:2008_1_710 cpe:/a:sap:sap_solution_manager_system:2008_1_740

CVE-2019-0293

2019-05-14T17:29:00.810-04:00

2019-05-16T11:58:33.150-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-16T11:28:15.677-04:00

BID 108324 MISC https://launchpad.support.sap.com/#/notes/2756625 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).

cpe:/a:sap:e-commerce:7.30 cpe:/a:sap:e-commerce:7.31 cpe:/a:sap:e-commerce:7.32 cpe:/a:sap:e-commerce:7.33 cpe:/a:sap:e-commerce:7.54

CVE-2019-0298

2019-05-14T17:29:00.903-04:00

2019-05-16T11:31:15.900-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-16T10:14:00.250-04:00

BID 108314 MISC https://launchpad.support.sap.com/#/notes/2773086 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.

cpe:/a:sap:identity_management:2.0

CVE-2019-0301

2019-05-14T17:29:01.013-04:00

2019-05-16T10:42:26.877-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-05-16T09:58:31.957-04:00

MISC https://launchpad.support.sap.com/#/notes/2784307 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing.

cpe:/a:sap:businessobjects:4.2 cpe:/a:sap:businessobjects:4.3

CVE-2019-0303

2019-06-14T15:29:00.277-04:00

2019-06-18T14:53:10.380-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-18T13:18:21.157-04:00

MISC https://launchpad.support.sap.com/#/notes/2637997 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.

cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.21 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.45 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.49 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.53 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.73 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl32uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64nuc:7.49 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.49 cpe:/a:sap:advanced_business_application_programming_platform_krnl64uc:7.73

CVE-2019-0304

2019-06-12T11:29:00.223-04:00

2019-06-14T09:59:25.363-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-13T15:07:46.470-04:00

MISC https://launchpad.support.sap.com/#/notes/2719530 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.

CVE-2019-0305

2019-06-12T11:29:00.270-04:00

2019-06-14T10:05:27.150-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T15:15:25.660-04:00

MISC https://launchpad.support.sap.com/#/notes/2755502 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data.

cpe:/a:sap:hana_extended_application_services:1.0

CVE-2019-0306

2019-06-12T11:29:00.330-04:00

2019-06-14T08:54:44.170-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T13:24:05.427-04:00

MISC https://launchpad.support.sap.com/#/notes/2771128 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names.

cpe:/a:sap:solution_manager:7.2

CVE-2019-0307

2019-06-12T11:29:00.377-04:00

2019-06-12T22:39:11.700-04:00

2.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-12T13:46:25.810-04:00

MISC https://launchpad.support.sap.com/#/notes/2772266 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.

cpe:/a:sap:e-commerce:7.30 cpe:/a:sap:e-commerce:7.31 cpe:/a:sap:e-commerce:7.32 cpe:/a:sap:e-commerce:7.33 cpe:/a:sap:e-commerce:7.54

CVE-2019-0308

2019-06-12T11:29:00.427-04:00

2019-06-12T22:07:30.667-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-12T13:54:46.113-04:00

MISC https://launchpad.support.sap.com/#/notes/2773493 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection.

cpe:/a:sap:r%2f3_enterprise:600 cpe:/a:sap:r%2f3_enterprise:602 cpe:/a:sap:r%2f3_enterprise:603 cpe:/a:sap:r%2f3_enterprise:604 cpe:/a:sap:r%2f3_enterprise:605 cpe:/a:sap:r%2f3_enterprise:606 cpe:/a:sap:r%2f3_enterprise:616 cpe:/a:sap:r%2f3_enterprise:617

CVE-2019-0311

2019-06-12T13:29:03.560-04:00

2019-06-14T08:52:10.670-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T13:16:07.200-04:00

MISC https://launchpad.support.sap.com/#/notes/2728153 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.

CVE-2019-0312

2019-06-12T13:29:03.623-04:00

2019-06-14T09:49:31.037-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T14:06:49.630-04:00

MISC https://launchpad.support.sap.com/#/notes/2744086 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings.

cpe:/a:sap:inventory_manager:4.3 cpe:/a:sap:work_manager:6.3 cpe:/a:sap:work_manager:6.4 cpe:/a:sap:work_manager:6.5

CVE-2019-0314

2019-06-12T13:29:03.670-04:00

2019-06-12T23:01:26.707-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-06-12T14:56:56.627-04:00

MISC https://launchpad.support.sap.com/#/notes/2793805 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

CVE-2019-0315

2019-06-12T13:29:03.747-04:00

2019-06-14T09:25:41.613-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T14:07:07.943-04:00

MISC https://launchpad.support.sap.com/#/notes/2755438 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an attacker to access passwords used in FTP channels leading to information disclosure.

CVE-2019-0316

2019-06-14T15:29:00.340-04:00

2019-10-10T08:08:25.800-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://launchpad.support.sap.com/#/notes/2745917 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242 SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim?s browser, by injecting malicious scripts in certain servlets, which will be executed when the victim is tricked to click on those malicious links, resulting in reflected Cross Site Scripting vulnerability.

cpe:/a:sap:netweaver_application_server_java:7.21 cpe:/a:sap:netweaver_application_server_java:7.22 cpe:/a:sap:netweaver_application_server_java:7.45 cpe:/a:sap:netweaver_application_server_java:7.49 cpe:/a:sap:netweaver_application_server_java:7.53

CVE-2019-0318

2019-07-10T15:15:10.143-04:00

2019-07-17T15:19:21.570-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T12:55:01.603-04:00

BID 109069 MISC https://launchpad.support.sap.com/#/notes/2738791 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:gateway:7.5 cpe:/a:sap:gateway:7.51 cpe:/a:sap:gateway:7.52 cpe:/a:sap:gateway:7.53 cpe:/a:sap:ui5:1.0.0

CVE-2019-0319

2019-07-10T15:15:10.220-04:00

2019-07-18T14:39:02.343-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T12:14:43.083-04:00

MISC http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html BID 109074 MISC https://cxsecurity.com/ascii/WLB-2019050283 MISC https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f MISC https://launchpad.support.sap.com/#/notes/2752614 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.

cpe:/a:sap:netweaver_as_abap:7.4 cpe:/a:sap:netweaver_as_abap:7.5 cpe:/a:sap:netweaver_as_abap:7.31

CVE-2019-0321

2019-07-10T15:15:10.297-04:00

2019-07-19T08:42:07.613-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T11:47:14.320-04:00

BID 109078 MISC https://launchpad.support.sap.com/#/notes/2773888 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:commerce_cloud:6.3 cpe:/a:sap:commerce_cloud:6.4 cpe:/a:sap:commerce_cloud:6.5 cpe:/a:sap:commerce_cloud:6.6 cpe:/a:sap:commerce_cloud:6.7 cpe:/a:sap:commerce_cloud:1808 cpe:/a:sap:commerce_cloud:1811

CVE-2019-0322

2019-07-10T15:15:10.377-04:00

2019-07-18T10:46:42.993-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-12T11:32:05.853-04:00

BID 109076 MISC https://launchpad.support.sap.com/#/notes/2781873 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

cpe:/a:sap:erp_hcm:3.0

CVE-2019-0325

2019-07-10T16:15:11.903-04:00

2019-07-18T13:09:20.303-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T11:17:40.937-04:00

BID 109075 MISC https://launchpad.support.sap.com/#/notes/2798133 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0326

2019-07-10T16:15:11.983-04:00

2019-07-17T14:47:24.950-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-12T09:46:54.027-04:00

BID 109072 MISC https://launchpad.support.sap.com/#/notes/2764733 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:netweaver_application_server_java:7.10 cpe:/a:sap:netweaver_application_server_java:7.20 cpe:/a:sap:netweaver_application_server_java:7.30 cpe:/a:sap:netweaver_application_server_java:7.31 cpe:/a:sap:netweaver_application_server_java:7.40 cpe:/a:sap:netweaver_application_server_java:7.50

CVE-2019-0327

2019-07-10T16:15:12.060-04:00

2019-07-18T09:36:16.003-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-07-12T09:40:16.537-04:00

BID 109071 MISC https://launchpad.support.sap.com/#/notes/2777910 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.

cpe:/a:sap:netweaver_process_integration:7.0 cpe:/a:sap:netweaver_process_integration:7.1 cpe:/a:sap:netweaver_process_integration:7.3 cpe:/a:sap:netweaver_process_integration:7.4 cpe:/a:sap:netweaver_process_integration:7.5 cpe:/a:sap:netweaver_process_integration:7.31

CVE-2019-0328

2019-07-10T16:15:12.123-04:00

2019-07-18T09:37:49.993-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-07-12T09:33:08.853-04:00

BID 109067 MISC https://launchpad.support.sap.com/#/notes/2774489 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands with privileged rights. An attacker could thereby impact the integrity and availability of the system.

cpe:/a:sap:information_steward:4.2

CVE-2019-0329

2019-07-10T16:15:12.200-04:00

2019-07-14T18:44:58.937-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-11T14:23:55.067-04:00

BID 109070 MISC https://launchpad.support.sap.com/#/notes/2804833 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:diagnostics_agents:7.20

CVE-2019-0330

2019-07-10T16:15:12.263-04:00

2019-07-15T15:17:42.147-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-07-12T11:56:17.887-04:00

BID 109068 MISC https://launchpad.support.sap.com/#/notes/2808158 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0331

2019-08-14T10:15:15.463-04:00

2019-08-26T15:11:53.967-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T12:26:26.477-04:00

MISC https://launchpad.support.sap.com/#/notes/2742468 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0332

2019-08-14T10:15:15.543-04:00

2019-08-19T09:58:56.803-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-16T15:40:24.650-04:00

MISC https://launchpad.support.sap.com/#/notes/2742468 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:businessobjects_business_intelligence:4.2

CVE-2019-0333

2019-08-14T10:15:15.607-04:00

2019-08-28T09:11:49.700-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T12:02:30.613-04:00

MISC https://launchpad.support.sap.com/#/notes/2764513 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can then query and receive the whole data set instead of just what is part of their authorized security profile, resulting in Information Disclosure.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0334

2019-08-14T10:15:15.713-04:00

2019-08-22T15:47:53.590-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T11:41:20.643-04:00

MISC https://launchpad.support.sap.com/#/notes/2771221 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script which when executed later could potentially allow a user to escalate privileges via session hijacking. The attacker could also access other sensitive information, leading to Stored Cross Site Scripting.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2 cpe:/a:sap:businessobjects_business_intelligence:4.3

CVE-2019-0335

2019-08-14T10:15:15.823-04:00

2019-08-26T09:56:54.077-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T11:18:43.243-04:00

MISC https://launchpad.support.sap.com/#/notes/2742468 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the description field in the list, when generating the little yellow informational pop up box, resulting in Stored Cross Site Scripting Attack.

CVE-2019-0337

2019-08-14T10:15:16.027-04:00

2019-08-26T09:59:34.927-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T11:14:03.683-04:00

MISC https://launchpad.support.sap.com/#/notes/2789866 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability

cpe:/a:sap:gateway:750 cpe:/a:sap:gateway:751 cpe:/a:sap:gateway:752 cpe:/a:sap:gateway:753

CVE-2019-0338

2019-08-14T10:15:16.167-04:00

2019-08-26T10:04:12.110-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T11:12:35.257-04:00

MISC https://launchpad.support.sap.com/#/notes/2793351 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing an attacker to access restricted information, resulting in Information Disclosure.

CVE-2019-0340

2019-08-14T10:15:16.260-04:00

2019-08-26T12:38:25.297-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T10:44:11.057-04:00

MISC https://launchpad.support.sap.com/#/notes/2794742 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. This issue affects the file upload at multiple locations. An attacker can read local XXE files.

cpe:/a:sap:enable_now:1902

CVE-2019-0341

2019-08-14T10:15:16.307-04:00

2019-08-26T11:15:03.220-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T10:26:27.883-04:00

MISC https://launchpad.support.sap.com/#/notes/2794742 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application, he could get access to the session cookie. The session cookie could then be abused to gain access to the application.

cpe:/a:sap:commerce_cloud:6.4 cpe:/a:sap:commerce_cloud:6.5 cpe:/a:sap:commerce_cloud:6.6 cpe:/a:sap:commerce_cloud:6.7 cpe:/a:sap:commerce_cloud:1808 cpe:/a:sap:commerce_cloud:1811 cpe:/a:sap:commerce_cloud:1905

CVE-2019-0343

2019-08-14T10:15:16.403-04:00

2019-08-23T12:46:00.570-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-08-22T11:08:20.150-04:00

MISC https://launchpad.support.sap.com/#/notes/2786035 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application.

CVE-2019-0344

2019-08-14T10:15:16.463-04:00

2019-08-26T13:07:05.343-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-22T11:22:28.003-04:00

MISC https://launchpad.support.sap.com/#/notes/2786035 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

cpe:/a:sap:netweaver_application_server_java:7.30 cpe:/a:sap:netweaver_application_server_java:7.31 cpe:/a:sap:netweaver_application_server_java:7.40 cpe:/a:sap:netweaver_application_server_java:7.50

CVE-2019-0345

2019-08-14T10:15:16.543-04:00

2019-08-23T12:57:21.247-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T12:09:36.680-04:00

MISC https://launchpad.support.sap.com/#/notes/2813811 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7.40, 7.50, by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console, resulting in Server-Side Request Forgery.

cpe:/a:sap:businessobjects_business_intelligence:4.2

CVE-2019-0346

2019-08-14T10:15:16.607-04:00

2019-08-23T12:58:54.310-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T12:25:34.490-04:00

MISC https://launchpad.support.sap.com/#/notes/2764513 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list of user names and roles imported from SAP NetWeaver BI systems, resulting in Information Disclosure.

cpe:/a:sap:businessobjects_business_intelligence:4.1 cpe:/a:sap:businessobjects_business_intelligence:4.2

CVE-2019-0348

2019-08-14T10:15:16.700-04:00

2019-08-22T15:55:58.250-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-22T12:15:00.853-04:00

MISC https://launchpad.support.sap.com/#/notes/2751470 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.

cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.21 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.21ext cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.22 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.22ext cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.49 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.53 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.73 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.75 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.76 cpe:/a:sap:advanced_business_application_programming_platform_kernel:7.77

CVE-2019-0349

2019-08-14T11:15:12.017-04:00

2019-10-10T08:08:26.533-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC https://launchpad.support.sap.com/#/notes/2798743 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute ?Go to statement? without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check

cpe:/a:sap:netweaver:7.10 cpe:/a:sap:netweaver:7.20 cpe:/a:sap:netweaver:7.30 cpe:/a:sap:netweaver:7.31 cpe:/a:sap:netweaver:7.40 cpe:/a:sap:netweaver:7.50

CVE-2019-0351

2019-08-14T10:15:16.807-04:00

2019-08-23T13:03:58.043-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-08-22T11:02:38.107-04:00

MISC https://launchpad.support.sap.com/#/notes/2800779 MISC https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this, an attacker can exploit Services Registry potentially enabling them to take complete control of the product, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.

cpe:/a:sap:businessobjects_business_intelligence_platform:4.10 cpe:/a:sap:businessobjects_business_intelligence_platform:4.20 cpe:/a:sap:businessobjects_business_intelligence_platform:4.30

CVE-2019-0352

2019-09-10T13:15:10.750-04:00

2019-09-11T08:20:29.977-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-10T14:43:47.023-04:00

MISC https://launchpad.support.sap.com/#/notes/2735924 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leads to an attacker can see the sensitive information via cache and can open the dynamic pages even after logout.

cpe:/a:sap:business_one_client:9.2 cpe:/a:sap:business_one_client:9.3

CVE-2019-0353

2019-09-10T13:15:10.827-04:00

2019-09-10T16:26:27.680-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-10T14:55:20.117-04:00

MISC https://launchpad.support.sap.com/#/notes/2768864 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would otherwise be restricted.

CVE-2019-0355

2019-09-10T13:15:10.923-04:00

2019-09-11T10:16:44.730-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-09-10T15:19:00.297-04:00

MISC https://launchpad.support.sap.com/#/notes/2798336 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.

cpe:/a:sap:netweaver_process_integration:7.31 cpe:/a:sap:netweaver_process_integration:7.40 cpe:/a:sap:netweaver_process_integration:7.50

CVE-2019-0356

2019-09-10T13:15:11.000-04:00

2019-10-10T08:08:26.707-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC https://launchpad.support.sap.com/#/notes/2802521 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 Under certain conditions SAP NetWeaver Process Integration Runtime Workbench ? MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.

cpe:/a:sap:hana:1.0 cpe:/a:sap:hana:2.0

CVE-2019-0357

2019-09-10T13:15:11.063-04:00

2019-09-11T10:06:55.127-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-09-10T20:20:14.007-04:00

MISC https://launchpad.support.sap.com/#/notes/2829681 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privileges.

cpe:/a:sap:supplier_relationship_management:3.73 cpe:/a:sap:supplier_relationship_management:7.31 cpe:/a:sap:supplier_relationship_management:7.32

CVE-2019-0361

2019-09-10T13:15:11.127-04:00

2019-09-11T10:04:22.087-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-10T15:45:13.163-04:00

MISC https://launchpad.support.sap.com/#/notes/2820607 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

cpe:/a:sap:hana_extended_application_services:1.0

CVE-2019-0363

2019-09-10T13:15:11.187-04:00

2019-09-11T09:59:19.400-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-09-10T20:33:28.557-04:00

MISC https://launchpad.support.sap.com/#/notes/2817491 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload the server or retrieve information about internal network ports.

cpe:/a:sap:hana_extended_application_services:1.0

CVE-2019-0364

2019-09-10T13:15:11.267-04:00

2019-09-11T09:41:29.223-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-10T20:27:55.450-04:00

cpe:/a:sap:sap_kernel:7.21 cpe:/a:sap:sap_kernel:7.49 cpe:/a:sap:sap_kernel:7.53 cpe:/a:sap:sap_kernel:7.73 cpe:/a:sap:sap_kernel:7.76 cpe:/a:sap:sap_kernel_krnl32nuc:7.21 cpe:/a:sap:sap_kernel_krnl32nuc:7.21ext cpe:/a:sap:sap_kernel_krnl32nuc:7.22 cpe:/a:sap:sap_kernel_krnl32nuc:7.22ext cpe:/a:sap:sap_kernel_krnl32uc:7.21 cpe:/a:sap:sap_kernel_krnl32uc:7.21ext cpe:/a:sap:sap_kernel_krnl32uc:7.22 cpe:/a:sap:sap_kernel_krnl32uc:7.22ext cpe:/a:sap:sap_kernel_krnl64nuc:7.21 cpe:/a:sap:sap_kernel_krnl64nuc:7.21ext cpe:/a:sap:sap_kernel_krnl64nuc:7.22 cpe:/a:sap:sap_kernel_krnl64nuc:7.22ext cpe:/a:sap:sap_kernel_krnl64uc:7.21 cpe:/a:sap:sap_kernel_krnl64uc:7.21ext cpe:/a:sap:sap_kernel_krnl64uc:7.22 cpe:/a:sap:sap_kernel_krnl64uc:7.22ext cpe:/a:sap:sap_kernel_krnl64uc:7.49 cpe:/a:sap:sap_kernel_krnl64uc:7.73

CVE-2019-0365

2019-09-10T13:15:11.330-04:00

2019-09-11T10:43:44.583-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-09-10T20:48:41.473-04:00

MISC https://launchpad.support.sap.com/#/notes/2786151 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506 SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

cpe:/a:sap:netweaver_process_integration:1.0 cpe:/a:sap:netweaver_process_integration:2.0

CVE-2019-0367

2019-10-08T16:15:10.903-04:00

2019-10-10T11:01:39.617-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:33:05.857-04:00

MISC https://launchpad.support.sap.com/#/notes/2805777 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.

CVE-2019-0368

2019-10-08T16:15:10.967-04:00

2019-10-08T16:30:36.507-04:00

MISC https://launchpad.support.sap.com/#/notes/2751806 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability.

cpe:/a:sap:financial_consolidation:10.0 cpe:/a:sap:financial_consolidation:10.1

CVE-2019-0369

2019-10-08T16:15:11.030-04:00

2019-10-10T15:48:59.997-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T14:42:22.377-04:00

MISC https://launchpad.support.sap.com/#/notes/2806403 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability.

cpe:/a:sap:financial_consolidation:10.0 cpe:/a:sap:financial_consolidation:10.1

CVE-2019-0370

2019-10-08T16:15:11.090-04:00

2019-10-11T09:27:31.857-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T14:36:08.170-04:00

MISC https://launchpad.support.sap.com/#/notes/2806403 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

cpe:/a:sap:businessobjects_business_intelligence_platform:4.0 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:- cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp10 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp11 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp12 cpe:/a:sap:businessobjects_business_intelligence_platform:4.2:sp04 cpe:/a:sap:businessobjects_business_intelligence_platform:4.2:sp05 cpe:/a:sap:businessobjects_business_intelligence_platform:4.2:sp06 cpe:/a:sap:businessobjects_business_intelligence_platform:4.2:sp07

CVE-2019-0374

2019-10-08T16:15:11.153-04:00

2019-10-10T14:04:55.307-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:42:14.537-04:00

MISC https://launchpad.support.sap.com/#/notes/2817945 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site Scripting

CVE-2019-0375

2019-10-08T16:15:11.217-04:00

2019-10-10T14:04:03.193-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:41:56.397-04:00

MISC https://launchpad.support.sap.com/#/notes/2817945 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.

CVE-2019-0376

2019-10-08T16:15:11.293-04:00

2019-10-10T14:02:54.580-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:31:36.790-04:00

MISC https://launchpad.support.sap.com/#/notes/2817945 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.

cpe:/a:sap:businessobjects_business_intelligence_platform:4.0 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp10 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp11 cpe:/a:sap:businessobjects_business_intelligence_platform:4.1:sp12

CVE-2019-0377

2019-10-08T16:15:11.357-04:00

2019-10-10T13:57:01.470-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:40:52.910-04:00

MISC https://launchpad.support.sap.com/#/notes/2817945 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.

CVE-2019-0378

2019-10-08T16:15:11.450-04:00

2019-10-10T13:56:34.657-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T09:32:15.870-04:00

MISC https://launchpad.support.sap.com/#/notes/2817945 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.

CVE-2019-0379

2019-10-08T16:15:11.513-04:00

2019-10-11T13:15:09.823-04:00

MISC https://launchpad.support.sap.com/#/notes/2826015 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default security provider is changed to BouncyCastle (BC), leading to Missing Authentication Check

CVE-2019-0380

2019-10-08T16:15:11.590-04:00

2019-10-10T08:08:27.143-04:00

MISC https://launchpad.support.sap.com/#/notes/2828682 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters? default values to be part of the application logs leading to Information Disclosure.

CVE-2019-0381

2019-10-08T16:15:11.653-04:00

2019-10-08T16:30:36.507-04:00

MISC https://launchpad.support.sap.com/#/notes/2792430 CONFIRM https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0536

2019-01-08T16:29:00.253-05:00

2019-05-08T18:03:15.923-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T11:41:16.953-05:00

BID 106406 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0536 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0549, CVE-2019-0554, CVE-2019-0569.

cpe:/a:microsoft:visual_studio:2010:sp1 cpe:/a:microsoft:visual_studio:2012:update_5

CVE-2019-0537

2019-01-08T16:29:00.317-05:00

2019-01-14T11:42:05.110-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T10:16:51.810-05:00

BID 106390 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0537 An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0538

2019-01-08T16:29:00.363-05:00

2019-01-14T13:31:22.073-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-14T11:26:43.157-05:00

BID 106419 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0538 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/a:microsoft:chakracore:- cpe:/a:microsoft:edge:-

CVE-2019-0539

2019-01-08T16:29:00.410-05:00

2019-03-05T08:45:52.130-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T07:47:20.203-05:00

BID 106401 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0539 EXPLOIT-DB 46203 EXPLOIT-DB 46204 EXPLOIT-DB 46485 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.

cpe:/a:microsoft:excel_viewer:- cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2013::~~rt~~~ cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016 cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:powerpoint_viewer:- cpe:/a:microsoft:word_viewer:-

CVE-2019-0540

2019-03-05T18:29:00.303-05:00

2019-03-07T13:17:27.850-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T12:33:17.987-05:00

BID 106863 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0540 A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

cpe:/a:microsoft:excel_viewer:2007:sp3 cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11 cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2013:sp1:~~rt~~~ cpe:/a:microsoft:office:2016 cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:office_word_viewer:-

CVE-2019-0541

2019-01-08T16:29:00.470-05:00

2019-03-14T13:05:08.467-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-14T12:47:26.840-04:00

BID 106402 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541 EXPLOIT-DB 46536 A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

cpe:/a:xtermjs:xterm.js:3.8.0 cpe:/a:xtermjs:xterm.js:3.9.0 cpe:/a:xtermjs:xterm.js:3.9.1 cpe:/a:xtermjs:xterm.js:3.10.0

CVE-2019-0542

2019-01-09T10:29:00.213-05:00

2019-06-10T15:29:00.247-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106434 REDHAT RHBA-2019:0959 REDHAT RHSA-2019:1422 REDHAT RHSA-2019:2551 REDHAT RHSA-2019:2552 MISC https://github.com/xtermjs/xterm.js/releases A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0543

2019-01-08T16:29:00.517-05:00

2019-02-26T15:57:16.950-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-26T15:50:20.053-05:00

BID 106408 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0543 EXPLOIT-DB 46156 An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

cpe:/a:microsoft:.net_core:2.1 cpe:/a:microsoft:.net_core:2.2 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1 cpe:/a:microsoft:.net_framework:4.6.2 cpe:/a:microsoft:.net_framework:4.7 cpe:/a:microsoft:.net_framework:4.7.1 cpe:/a:microsoft:.net_framework:4.7.2

CVE-2019-0545

2019-01-08T16:29:00.580-05:00

2019-01-14T15:54:31.503-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T14:57:10.287-05:00

BID 106405 REDHAT RHSA-2019:0040 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0545 An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.

cpe:/a:microsoft:visual_studio_2017:15.9

CVE-2019-0546

2019-01-08T16:29:00.613-05:00

2019-01-15T10:20:03.827-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-14T12:59:55.457-05:00

BID 106391 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0546 A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio.

cpe:/o:microsoft:windows_10:1803

CVE-2019-0547

2019-01-08T16:29:00.660-05:00

2019-01-15T16:33:18.420-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-14T12:45:30.717-05:00

BID 106394 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0547 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Client Remote Code Execution Vulnerability." This affects Windows 10, Windows 10 Servers.

cpe:/a:microsoft:asp.net_core:2.1 cpe:/a:microsoft:asp.net_core:2.2

CVE-2019-0548

2019-01-08T16:29:00.707-05:00

2019-01-15T09:02:28.797-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-14T12:32:35.807-05:00

BID 106410 REDHAT RHSA-2019:0040 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0548 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0549

2019-01-08T16:29:00.753-05:00

2019-05-08T18:03:15.923-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T12:17:57.963-05:00

BID 106409 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0549 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0554, CVE-2019-0569.

cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0550

2019-01-08T16:29:00.783-05:00

2019-01-14T12:57:12.937-05:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-01-14T12:06:59.013-05:00

BID 106385 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0550 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019. This CVE ID is unique from CVE-2019-0551.

cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0551

2019-01-08T16:29:00.817-05:00

2019-01-14T12:55:34.653-05:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-01-14T12:04:21.433-05:00

BID 106386 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0551 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0550.

CVE-2019-0552

2019-01-08T16:29:00.877-05:00

2019-01-15T09:25:09.653-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-14T14:47:46.790-05:00

BID 106407 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0552 EXPLOIT-DB 46162 An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0553

2019-01-08T16:29:00.923-05:00

2019-01-14T15:46:03.063-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T14:35:46.007-05:00

BID 106412 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0553 An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows Subsystem for Linux Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

CVE-2019-0554

2019-01-08T16:29:00.957-05:00

2019-05-08T18:03:15.923-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T14:32:28.857-05:00

BID 106411 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0554 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0549, CVE-2019-0569.

CVE-2019-0555

2019-01-08T16:29:01.003-05:00

2019-02-26T15:53:09.587-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-26T15:47:55.490-05:00

BID 106395 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0555 EXPLOIT-DB 46185 An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft XmlDocument Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

cpe:/a:microsoft:sharepoint_server:2013:sp1:~~enterprise~~~

CVE-2019-0556

2019-01-08T16:29:01.050-05:00

2019-01-15T09:52:21.527-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:35:57.397-05:00

BID 106387 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0556 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2019-0557, CVE-2019-0558.

cpe:/a:microsoft:sharepoint_server:2016::~~enterprise~~~

CVE-2019-0557

2019-01-08T16:29:01.080-05:00

2019-01-15T09:52:14.263-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:37:09.463-05:00

BID 106388 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0557 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2019-0556, CVE-2019-0558.

cpe:/a:microsoft:business_productivity_servers:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013:sp1:~~enterprise~~~ cpe:/a:microsoft:sharepoint_server:2016::~~enterprise~~~ cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0558

2019-01-08T16:29:01.127-05:00

2019-01-15T09:52:06.120-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:39:42.720-05:00

BID 106389 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0558 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint, Microsoft Business Productivity Servers. This CVE ID is unique from CVE-2019-0556, CVE-2019-0557.

cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:outlook:2010:sp2 cpe:/a:microsoft:outlook:2013:sp1 cpe:/a:microsoft:outlook:2013:sp1:~~rt~~~ cpe:/a:microsoft:outlook:2016

CVE-2019-0559

2019-01-08T16:29:01.160-05:00

2019-01-11T16:28:00.347-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-11T14:26:24.233-05:00

BID 106397 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0559 An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.

CVE-2019-0560

2019-01-08T16:29:01.190-05:00

2019-01-11T16:25:12.000-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-11T14:42:53.633-05:00

BID 106398 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0560 An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office.

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2016::~~~mac_os_x~~ cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office:2019::~~~mac_os_x~~ cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:office_web_apps_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_automation_services:-

CVE-2019-0561

2019-01-08T16:29:01.220-05:00

2019-01-14T08:44:22.273-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T08:20:38.803-05:00

BID 106399 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0561 An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability." This affects Microsoft Word, Office 365 ProPlus, Microsoft Office, Word.

cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1 cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0562

2019-01-08T16:29:01.267-05:00

2019-01-30T14:47:26.003-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-14T08:09:00.737-05:00

BID 106400 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0562 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint.

cpe:/a:microsoft:asp.net_core:2.1

CVE-2019-0564

2019-01-08T16:29:01.317-05:00

2019-01-11T16:30:38.007-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-11T14:33:56.647-05:00

BID 106413 REDHAT RHSA-2019:0040 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0564 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

cpe:/a:microsoft:edge:-

CVE-2019-0565

2019-01-08T16:29:01.347-05:00

2019-01-11T16:19:30.130-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-01-11T14:53:35.097-05:00

BID 106416 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0565 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.

cpe:/a:microsoft:edge:-

CVE-2019-0566

2019-01-08T16:29:01.393-05:00

2019-02-26T16:08:55.710-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-26T15:45:27.503-05:00

BID 106417 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0566 EXPLOIT-DB 46161 An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This affects Microsoft Edge.

cpe:/a:microsoft:chakracore:- cpe:/a:microsoft:edge:-

CVE-2019-0567

2019-01-08T16:29:01.423-05:00

2019-02-26T15:49:31.850-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-02-26T15:46:15.017-05:00

BID 106418 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0567 EXPLOIT-DB 46203 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568.

cpe:/a:microsoft:chakracore:- cpe:/a:microsoft:edge:-

CVE-2019-0568

2019-01-08T16:29:01.457-05:00

2019-02-26T15:40:41.857-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-02-26T15:18:17.370-05:00

BID 106420 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0568 EXPLOIT-DB 46205 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0567.

CVE-2019-0569

2019-01-08T16:29:01.503-05:00

2019-05-08T18:03:15.923-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:42:35.697-05:00

BID 106414 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0569 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0536, CVE-2019-0549, CVE-2019-0554.

CVE-2019-0570

2019-01-08T16:29:01.533-05:00

2019-01-22T14:54:37.547-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-01-15T09:42:57.643-05:00

BID 106415 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0570 EXPLOIT-DB 46184 An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

CVE-2019-0571

2019-01-08T16:29:01.567-05:00

2019-01-15T11:20:59.330-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-01-15T09:41:09.010-05:00

BID 106426 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0571 EXPLOIT-DB 46159 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0572, CVE-2019-0573, CVE-2019-0574.

CVE-2019-0572

2019-01-08T16:29:01.613-05:00

2019-01-15T11:20:17.957-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-01-15T09:34:55.560-05:00

BID 106428 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0572 EXPLOIT-DB 46157 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0573, CVE-2019-0574.

CVE-2019-0573

2019-01-08T16:29:01.660-05:00

2019-01-15T11:19:52.847-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-01-15T09:34:17.820-05:00

BID 106430 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0573 EXPLOIT-DB 46158 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0574.

CVE-2019-0574

2019-01-08T16:29:01.707-05:00

2019-01-15T11:19:28.640-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-01-15T09:33:07.427-05:00

BID 106431 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0574 EXPLOIT-DB 46160 An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0572, CVE-2019-0573.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0575

2019-01-08T16:29:01.753-05:00

2019-01-16T08:16:10.487-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:47:16.027-05:00

BID 106404 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0575 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0576

2019-01-08T16:29:01.800-05:00

2019-01-16T08:15:43.957-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:45:50.447-05:00

BID 106422 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0576 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0577

2019-01-08T16:29:01.847-05:00

2019-01-16T08:15:15.550-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:41:34.177-05:00

BID 106423 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0577 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0578

2019-01-08T16:29:01.893-05:00

2019-01-16T08:11:29.793-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:41:13.317-05:00

BID 106424 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0578 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0579

2019-01-08T16:29:01.923-05:00

2019-01-16T08:10:42.293-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:40:34.237-05:00

BID 106425 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0579 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0580

2019-01-08T16:29:01.970-05:00

2019-01-16T08:09:55.887-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:34:07.840-05:00

BID 106429 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0580 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0581

2019-01-08T16:29:02.003-05:00

2019-01-16T08:09:16.213-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:33:33.277-05:00

BID 106432 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0581 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0582

2019-01-08T16:29:02.050-05:00

2019-01-16T08:07:58.727-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:32:50.277-05:00

BID 106433 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0582 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0583, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0583

2019-01-08T16:29:02.097-05:00

2019-01-16T07:53:51.710-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:32:03.947-05:00

BID 106435 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0583 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0584.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0584

2019-01-08T16:29:02.127-05:00

2019-01-15T17:01:36.610-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T11:31:18.697-05:00

BID 106436 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0584 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583.

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2016::~~~mac_os_x~~ cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office:2019::~~~mac_os_x~~ cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:office_online_server:- cpe:/a:microsoft:office_web_apps_server:2010:sp2 cpe:/a:microsoft:office_word_viewer:- cpe:/a:microsoft:sharepoint_server:2013:sp1:~~enterprise~~~ cpe:/a:microsoft:sharepoint_server:2016::~~enterprise~~~ cpe:/a:microsoft:sharepoint_server:2019 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_automation_services:-

CVE-2019-0585

2019-01-08T16:29:02.173-05:00

2019-01-15T11:10:34.217-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T09:20:56.930-05:00

BID 106392 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0585 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Word, Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Microsoft SharePoint, Microsoft Office Online Server, Microsoft Word, Microsoft SharePoint Server.

cpe:/a:microsoft:exchange_server:2016:cumulative_update_10 cpe:/a:microsoft:exchange_server:2016:cumulative_update_11 cpe:/a:microsoft:exchange_server:2019

CVE-2019-0586

2019-01-08T16:29:02.207-05:00

2019-01-15T13:07:13.343-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-01-15T08:33:32.247-05:00

BID 106421 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0586 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.

cpe:/a:microsoft:exchange_server:2010:sp3_rollup25 cpe:/a:microsoft:exchange_server:2013:cumulative_update_21 cpe:/a:microsoft:exchange_server:2016:cumulative_update_10 cpe:/a:microsoft:exchange_server:2016:cumulative_update_11 cpe:/a:microsoft:exchange_server:2019

CVE-2019-0588

2019-01-08T16:29:02.237-05:00

2019-01-15T15:51:28.770-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:28:36.680-05:00

BID 106437 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0588 An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange Information Disclosure Vulnerability." This affects Microsoft Exchange Server.

cpe:/a:microsoft:chakracore:- cpe:/a:microsoft:chakracore:1.2.0 cpe:/a:microsoft:chakracore:1.2.0.0 cpe:/a:microsoft:chakracore:1.2.1 cpe:/a:microsoft:chakracore:1.2.2 cpe:/a:microsoft:chakracore:1.2.3 cpe:/a:microsoft:chakracore:1.3.0 cpe:/a:microsoft:chakracore:1.3.1 cpe:/a:microsoft:chakracore:1.3.2 cpe:/a:microsoft:chakracore:1.4.0 cpe:/a:microsoft:chakracore:1.4.1 cpe:/a:microsoft:chakracore:1.4.2 cpe:/a:microsoft:chakracore:1.4.3 cpe:/a:microsoft:chakracore:1.4.4 cpe:/a:microsoft:chakracore:1.4.5 cpe:/a:microsoft:chakracore:1.5.0 cpe:/a:microsoft:chakracore:1.5.1 cpe:/a:microsoft:chakracore:1.5.2 cpe:/a:microsoft:chakracore:1.5.3 cpe:/a:microsoft:chakracore:1.6.0 cpe:/a:microsoft:chakracore:1.6.1 cpe:/a:microsoft:chakracore:1.6.2 cpe:/a:microsoft:chakracore:1.7.0 cpe:/a:microsoft:chakracore:1.7.1 cpe:/a:microsoft:chakracore:1.7.2 cpe:/a:microsoft:chakracore:1.7.3 cpe:/a:microsoft:chakracore:1.7.4 cpe:/a:microsoft:chakracore:1.7.5 cpe:/a:microsoft:chakracore:1.7.6 cpe:/a:microsoft:chakracore:1.8.0 cpe:/a:microsoft:chakracore:1.8.1 cpe:/a:microsoft:chakracore:1.8.2 cpe:/a:microsoft:chakracore:1.8.3 cpe:/a:microsoft:chakracore:1.8.4 cpe:/a:microsoft:chakracore:1.8.5 cpe:/a:microsoft:chakracore:1.10.0 cpe:/a:microsoft:chakracore:1.10.1 cpe:/a:microsoft:chakracore:1.10.2 cpe:/a:microsoft:chakracore:1.11.0 cpe:/a:microsoft:chakracore:1.11.1 cpe:/a:microsoft:chakracore:1.11.2 cpe:/a:microsoft:chakracore:1.11.3 cpe:/a:microsoft:chakracore:1.11.4 cpe:/a:microsoft:chakracore:1.11.5 cpe:/a:microsoft:edge:-

CVE-2019-0590

2019-03-05T18:29:00.333-05:00

2019-03-06T13:26:35.640-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:02:23.190-05:00

BID 106934 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0590 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

CVE-2019-0591

2019-03-05T18:29:00.380-05:00

2019-03-06T13:26:58.783-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:01:41.270-05:00

BID 106935 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0591 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

CVE-2019-0592

2019-04-08T19:29:00.337-04:00

2019-04-09T10:54:37.413-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T10:02:56.147-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0592 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0611.

CVE-2019-0593

2019-03-05T18:29:00.410-05:00

2019-03-06T13:25:25.337-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:01:30.317-05:00

BID 106936 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0593 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0594

2019-03-05T18:29:00.443-05:00

2019-06-10T09:46:03.853-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-06-10T09:36:56.567-04:00

BID 106866 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0594 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0595

2019-03-05T18:29:00.473-05:00

2019-07-24T04:15:10.073-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 106921 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10289 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0595 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0596

2019-03-05T18:29:00.507-05:00

2019-05-08T18:03:15.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T11:54:39.567-05:00

BID 106922 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0596 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0597

2019-03-05T18:29:00.537-05:00

2019-05-08T18:03:15.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T11:42:39.977-05:00

BID 106923 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0597 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0598

2019-03-05T18:29:00.583-05:00

2019-05-08T18:03:15.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T11:36:55.890-05:00

BID 106924 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0598 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0599, CVE-2019-0625.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0599

2019-03-05T18:29:00.630-05:00

2019-05-08T18:03:15.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T11:11:49.317-05:00

BID 106925 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0599 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0625.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0600

2019-03-05T18:29:00.660-05:00

2019-03-06T14:18:37.167-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T10:53:51.277-05:00

BID 106868 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0600 An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0601.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0601

2019-03-05T18:29:00.693-05:00

2019-03-06T12:12:40.250-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T10:44:00.627-05:00

BID 106883 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0601 An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0600.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~itanium~~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~x64~~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0602

2019-03-05T18:29:00.740-05:00

2019-03-06T11:17:58.037-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T10:29:53.317-05:00

BID 106858 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0602 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.

cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0603

2019-04-08T19:29:00.387-04:00

2019-05-08T18:03:15.643-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:43:56.327-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0603 A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker could create a specially crafted request, causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows Deployment Services TFTP Server handles objects in memory, aka 'Windows Deployment Services TFTP Server Remote Code Execution Vulnerability'.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0604

2019-03-05T18:29:00.757-05:00

2019-06-10T09:45:54.103-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-06-10T09:14:39.653-04:00

BID 106914 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.

CVE-2019-0605

2019-03-05T18:29:00.787-05:00

2019-03-06T13:33:47.653-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:30:21.127-05:00

BID 106905 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0605 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0606

2019-03-05T18:29:00.817-05:00

2019-03-06T16:48:21.937-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:40:04.497-05:00

BID 106859 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0606 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.

CVE-2019-0607

2019-03-05T18:29:00.863-05:00

2019-03-06T13:33:39.577-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:28:16.197-05:00

BID 106907 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0607 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0608

2019-10-10T10:15:14.157-04:00

2019-10-11T16:27:10.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-10-10T14:34:51.947-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608 A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1357.

CVE-2019-0609

2019-04-08T19:29:00.417-04:00

2019-04-09T10:58:55.697-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:34:49.683-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0609 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

CVE-2019-0610

2019-03-05T18:29:00.897-05:00

2019-03-06T13:24:56.130-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:21:20.567-05:00

BID 106908 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0610 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

CVE-2019-0611

2019-04-08T19:29:00.463-04:00

2019-04-09T11:03:41.507-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T10:01:25.627-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0611 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0592.

cpe:/a:microsoft:edge:-

CVE-2019-0612

2019-04-08T19:29:00.493-04:00

2019-04-09T12:51:48.017-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T10:16:14.940-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0612 A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.

CVE-2019-0613

2019-03-05T18:29:00.927-05:00

2019-03-06T11:03:50.977-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T07:41:42.970-05:00

BID 106872 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0613 A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework and Visual Studio Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0614

2019-04-08T19:29:00.540-04:00

2019-04-09T11:14:16.187-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T10:09:59.167-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0614 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0774.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0615

2019-03-05T18:29:00.957-05:00

2019-03-06T11:18:19.567-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T08:36:28.517-05:00

BID 106860 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0615 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0616

2019-03-05T18:29:00.990-05:00

2019-03-06T11:20:55.187-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T08:33:47.267-05:00

BID 106867 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0616 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0619, CVE-2019-0660, CVE-2019-0664.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0617

2019-04-08T19:29:00.573-04:00

2019-04-09T10:00:06.173-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:44:18.057-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0617 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0618

2019-03-05T18:29:01.007-05:00

2019-03-06T10:56:09.450-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T07:49:24.180-05:00

BID 106878 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0618 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0662.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0619

2019-03-05T18:29:01.053-05:00

2019-03-06T11:01:17.567-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T08:33:31.860-05:00

BID 106864 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0619 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0660, CVE-2019-0664.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0620

2019-06-12T10:29:01.117-04:00

2019-06-12T15:49:14.167-04:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:22:03.100-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0620 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0709, CVE-2019-0722.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0621

2019-03-05T18:29:01.083-05:00

2019-03-06T18:52:54.117-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T17:01:26.163-05:00

BID 106873 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0621 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0661, CVE-2019-0663.

cpe:/a:microsoft:skype:8.35::~~~android~~

CVE-2019-0622

2019-01-08T16:29:02.317-05:00

2019-01-28T11:56:46.827-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-15T08:14:43.930-05:00

BID 106465 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0622 An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevation of Privilege Vulnerability." This affects Skype 8.35.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803

CVE-2019-0623

2019-03-05T18:29:01.113-05:00

2019-03-06T10:29:01.770-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T08:20:46.130-05:00

BID 106891 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0623 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:skype_for_business:2015:cu8

CVE-2019-0624

2019-01-17T13:29:00.287-05:00

2019-01-22T08:31:27.653-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-18T12:10:59.157-05:00

BID 106663 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0624 A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0625

2019-03-05T18:29:01.160-05:00

2019-03-06T12:35:49.163-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T08:15:40.593-05:00

BID 106926 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0625 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595, CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0626

2019-03-05T18:29:01.193-05:00

2019-03-06T10:51:24.913-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T07:10:40.377-05:00

BID 106887 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0626 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.

cpe:/a:microsoft:powershell_core:6.1 cpe:/a:microsoft:powershell_core:6.2 cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0627

2019-03-05T18:29:01.223-05:00

2019-03-06T14:43:50.487-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T12:36:51.320-05:00

BID 106857 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0627 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0631, CVE-2019-0632.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0628

2019-03-05T18:29:01.257-05:00

2019-03-06T17:12:43.307-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:15:20.593-05:00

BID 106893 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0628 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0630

2019-03-05T18:29:01.287-05:00

2019-03-07T10:56:14.543-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-03-07T10:22:05.257-05:00

BID 106876 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0630 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0633.

CVE-2019-0631

2019-03-05T18:29:01.333-05:00

2019-03-06T14:43:36.160-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T12:37:28.587-05:00

BID 106875 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0631 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0632.

CVE-2019-0632

2019-03-05T18:29:01.350-05:00

2019-03-06T14:43:45.877-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T12:17:43.823-05:00

BID 106880 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0632 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0627, CVE-2019-0631.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0633

2019-03-05T18:29:01.380-05:00

2019-03-07T10:55:59.527-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-03-07T10:20:48.570-05:00

BID 106916 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0633 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0630.

cpe:/a:microsoft:edge:-

CVE-2019-0634

2019-03-05T18:29:01.410-05:00

2019-03-07T13:15:42.777-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T11:31:30.243-05:00

BID 106899 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0634 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0645, CVE-2019-0650.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0635

2019-03-05T18:29:01.443-05:00

2019-03-12T16:24:04.980-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

NONE

http://nvd.nist.gov

2019-03-06T14:15:27.820-05:00

BID 106884 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0635 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0636

2019-03-05T18:29:01.473-05:00

2019-03-06T12:21:09.527-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T10:51:56.197-05:00

BID 106895 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0636 An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0637

2019-03-05T18:29:01.520-05:00

2019-03-07T13:44:43.863-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T15:25:28.933-05:00

BID 106879 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0637 A security feature bypass vulnerability exists when Windows Defender Firewall incorrectly applies firewall profiles to cellular network connections, aka 'Windows Defender Firewall Security Feature Bypass Vulnerability'.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0639

2019-04-08T19:29:00.603-04:00

2019-04-09T11:32:24.417-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:28:35.723-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0639 A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

CVE-2019-0640

2019-03-05T18:29:01.553-05:00

2019-03-06T14:04:12.343-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:38:38.183-05:00

BID 106910 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0640 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:edge:-

CVE-2019-0641

2019-03-05T18:29:01.583-05:00

2019-03-07T13:07:35.050-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:20:31.793-05:00

BID 106871 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0641 A security feature bypass vulnerability exists in Microsoft Edge handles whitelisting, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.

CVE-2019-0642

2019-03-05T18:29:01.613-05:00

2019-03-06T13:33:25.543-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:29:23.467-05:00

BID 106911 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0642 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:edge:-

CVE-2019-0643

2019-03-05T18:29:01.660-05:00

2019-03-07T13:03:55.597-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:09:35.010-05:00

BID 106874 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0643 An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnerability'.

CVE-2019-0644

2019-03-05T18:29:01.693-05:00

2019-03-06T12:37:40.977-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:05:42.497-05:00

BID 106889 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0644 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.

cpe:/a:microsoft:edge:-

CVE-2019-0645

2019-03-05T18:29:01.723-05:00

2019-03-07T07:48:39.717-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:05:34.717-05:00

BID 106896 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0645 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0650.

cpe:/a:microsoft:team_foundation_server:2018:3.2

CVE-2019-0646

2019-01-17T13:29:00.443-05:00

2019-01-22T08:21:32.337-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-01-18T10:18:42.220-05:00

BID 106651 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0646 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2

CVE-2019-0647

2019-01-17T13:29:00.507-05:00

2019-02-26T15:25:41.673-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-26T15:17:20.947-05:00

BID 106650 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0647 An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.

cpe:/a:microsoft:edge:-

CVE-2019-0648

2019-03-05T18:29:01.757-05:00

2019-03-08T10:47:11.790-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:43:30.223-05:00

BID 106885 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648 An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data.To exploit the vulnerability, an attacker must know the memory address of where the object was created.The update addresses the vulnerability by changing the way certain functions handle objects in memory, aka Scripting Engine Information Disclosure Vulnerability. This CVE ID is unique from CVE-2019-0658.

CVE-2019-0649

2019-03-05T18:29:01.803-05:00

2019-03-07T15:10:43.077-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T14:24:28.843-05:00

BID 106877 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0649 A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.

cpe:/a:microsoft:edge:-

CVE-2019-0650

2019-03-05T18:29:01.833-05:00

2019-03-06T14:02:20.810-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:00:34.557-05:00

BID 106901 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0650 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0645.

CVE-2019-0651

2019-03-05T18:29:01.863-05:00

2019-03-06T12:37:08.773-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:02:55.730-05:00

BID 106902 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0651 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0652, CVE-2019-0655.

CVE-2019-0652

2019-03-05T18:29:01.910-05:00

2019-03-06T12:36:38.053-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:02:39.103-05:00

BID 106903 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0652 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0655.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0654

2019-03-05T18:29:01.943-05:00

2019-03-06T14:59:48.797-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T14:39:45.583-05:00

BID 106881 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0654 A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects, aka 'Microsoft Browser Spoofing Vulnerability'.

CVE-2019-0655

2019-03-05T18:29:01.973-05:00

2019-03-06T12:35:20.380-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:02:48.463-05:00

BID 106912 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0655 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0605, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652.

CVE-2019-0656

2019-03-05T18:29:02.007-05:00

2019-03-07T12:01:29.117-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T12:58:16.827-05:00

BID 106898 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0656 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:.net_core:1.0 cpe:/a:microsoft:.net_core:2.1 cpe:/a:microsoft:.net_core:2.2 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1 cpe:/a:microsoft:.net_framework:4.6.2 cpe:/a:microsoft:.net_framework:4.7 cpe:/a:microsoft:.net_framework:4.7.1 cpe:/a:microsoft:.net_framework:4.7.2 cpe:/a:microsoft:powershell_core:6.0 cpe:/a:microsoft:powershell_core:6.1 cpe:/a:microsoft:visual_studio_2017:- cpe:/a:microsoft:visual_studio_2017:15.9

CVE-2019-0657

2019-03-05T18:29:02.037-05:00

2019-03-07T11:55:52.720-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-07T08:09:55.000-05:00

BID 106890 REDHAT RHSA-2019:0349 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0657 A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.

CVE-2019-0658

2019-03-05T18:29:02.067-05:00

2019-03-07T12:12:39.993-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-07T12:02:10.630-05:00

BID 106882 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0658 An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0648.

CVE-2019-0659

2019-03-05T18:29:02.100-05:00

2019-03-07T15:24:08.433-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-06T14:40:42.760-05:00

BID 106892 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0659 An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0660

2019-03-05T18:29:02.147-05:00

2019-03-06T18:45:20.893-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:12:29.527-05:00

BID 106869 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0660 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0664.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:-

CVE-2019-0661

2019-03-05T18:29:02.177-05:00

2019-03-06T17:09:03.067-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:55:17.150-05:00

BID 106870 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0661 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621, CVE-2019-0663.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0662

2019-03-05T18:29:02.207-05:00

2019-03-06T13:58:55.903-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T13:18:19.817-05:00

BID 106888 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0662 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0618.

CVE-2019-0663

2019-03-05T18:29:02.240-05:00

2019-03-08T14:56:00.383-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T18:52:49.837-05:00

BID 107098 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0663 An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621, CVE-2019-0661.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2019-0664

2019-03-05T18:29:02.287-05:00

2019-03-06T18:44:45.563-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T13:08:52.323-05:00

BID 106862 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0664 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0602, CVE-2019-0615, CVE-2019-0616, CVE-2019-0619, CVE-2019-0660.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0665

2019-04-08T19:29:00.637-04:00

2019-04-09T11:32:18.103-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:26:26.720-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0665 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0666, CVE-2019-0667, CVE-2019-0772.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0666

2019-04-08T19:29:00.683-04:00

2019-04-09T11:37:15.283-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:24:39.703-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0666 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0667, CVE-2019-0772.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0667

2019-04-08T19:29:00.713-04:00

2019-04-09T11:44:04.370-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:24:35.763-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0667 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0772.

cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1 cpe:/a:microsoft:sharepoint_enterprise_server:2016

CVE-2019-0668

2019-03-05T18:29:02.317-05:00

2019-03-06T12:26:52.893-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-03-06T11:15:21.913-05:00

BID 106894 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0668 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:excel:2010:sp2 cpe:/a:microsoft:excel:2013:sp1 cpe:/a:microsoft:excel:2013:sp1:~~rt~~~ cpe:/a:microsoft:excel:2016 cpe:/a:microsoft:excel_viewer:- cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2016::~~~mac_os_x~~ cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office:2019::~~~mac_os_x~~ cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:office_compatibility_pack:-:sp3

CVE-2019-0669

2019-03-05T18:29:02.350-05:00

2019-03-08T14:09:24.437-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-05T23:27:17.043-05:00

BID 106897 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0669 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.

cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1 cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0670

2019-03-05T18:29:02.410-05:00

2019-03-06T16:23:03.777-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T11:16:30.623-05:00

BID 106900 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0670 A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerability'.

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2013:sp1:~~rt~~~ cpe:/a:microsoft:office:2016 cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office_365_proplus:-

CVE-2019-0671

2019-03-05T18:29:02.457-05:00

2019-03-06T10:53:47.480-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T23:24:40.213-05:00

BID 106928 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0671 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0672, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675.

CVE-2019-0672

2019-03-05T18:29:02.507-05:00

2019-03-06T10:51:12.947-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T23:24:13.227-05:00

BID 106929 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0672 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0673, CVE-2019-0674, CVE-2019-0675.

CVE-2019-0673

2019-03-05T18:29:02.537-05:00

2019-03-06T10:22:13.827-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T23:23:14.697-05:00

BID 106930 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0673 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0674, CVE-2019-0675.

CVE-2019-0674

2019-03-05T18:29:02.553-05:00

2019-03-06T10:17:30.087-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T23:23:48.040-05:00

BID 106931 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0674 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0675.

cpe:/a:microsoft:office:2010:sp2

CVE-2019-0675

2019-03-05T18:29:02.583-05:00

2019-03-06T10:10:48.363-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-05T23:17:45.533-05:00

BID 106932 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0675 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671, CVE-2019-0672, CVE-2019-0673, CVE-2019-0674.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0676

2019-03-05T18:29:02.613-05:00

2019-03-06T18:37:24.153-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T12:45:45.660-05:00

BID 106886 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676 An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.

cpe:/a:microsoft:edge:-

CVE-2019-0678

2019-04-08T20:29:00.230-04:00

2019-04-09T12:40:07.973-04:00

4.0

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T09:12:24.387-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0678 An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0680

2019-04-08T20:29:00.277-04:00

2019-04-09T10:58:43.133-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T09:02:29.453-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0680 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

CVE-2019-0682

2019-04-08T20:29:00.327-04:00

2019-04-09T11:41:13.927-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T08:55:46.017-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0682 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0689, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0683

2019-04-08T20:29:00.370-04:00

2019-04-10T10:22:54.697-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T08:52:40.107-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0683 An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'.

CVE-2019-0685

2019-04-09T17:29:00.270-04:00

2019-04-10T15:16:52.693-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T12:35:25.820-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0685 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0803, CVE-2019-0859.

cpe:/a:microsoft:exchange_server:2010:sp3_rollup26 cpe:/a:microsoft:exchange_server:2013:cumulative_update_22 cpe:/a:microsoft:exchange_server:2016:cumulative_update_12 cpe:/a:microsoft:exchange_server:2019:cumulative_update_1

CVE-2019-0686

2019-03-05T18:29:02.647-05:00

2019-03-06T14:07:50.580-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-06T11:13:29.420-05:00

BID 106937 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.

CVE-2019-0688

2019-04-09T17:29:00.317-04:00

2019-07-09T14:15:10.747-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107685 MISC https://arxiv.org/pdf/1906.10478.pdf MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0688 An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosure Vulnerability'.

CVE-2019-0689

2019-04-08T20:29:00.403-04:00

2019-04-09T13:08:38.763-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:43:15.507-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0689 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0690

2019-04-08T20:29:00.433-04:00

2019-05-08T18:03:15.643-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T12:48:11.153-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0690 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0695, CVE-2019-0701.

CVE-2019-0692

2019-04-08T20:29:00.480-04:00

2019-04-09T13:06:35.000-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:39:43.737-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0692 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0693, CVE-2019-0694.

CVE-2019-0693

2019-04-08T20:29:00.527-04:00

2019-04-09T13:06:20.890-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:39:23.190-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0693 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0692, CVE-2019-0694.

CVE-2019-0694

2019-04-08T20:29:00.560-04:00

2019-04-09T13:05:58.497-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:38:39.860-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0694 An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0682, CVE-2019-0689, CVE-2019-0692, CVE-2019-0693.

CVE-2019-0695

2019-04-08T20:29:00.590-04:00

2019-04-09T16:55:00.323-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T12:25:09.127-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0695 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0701.

CVE-2019-0696

2019-04-08T20:29:00.637-04:00

2019-04-09T15:08:19.887-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T12:18:25.447-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0696 An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019

CVE-2019-0697

2019-04-08T20:29:00.653-04:00

2019-04-09T13:31:28.007-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:09:34.303-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0697 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0698, CVE-2019-0726.

cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019

CVE-2019-0698

2019-04-08T20:29:00.717-04:00

2019-04-09T13:57:34.437-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T12:07:47.803-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0698 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0726.

cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0701

2019-04-08T20:29:00.777-04:00

2019-04-09T15:15:14.637-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T12:24:46.237-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0701 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0695.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0702

2019-04-08T20:29:00.827-04:00

2019-05-08T18:03:15.643-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:38:46.927-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0702 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0755, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0703

2019-04-08T20:29:00.887-04:00

2019-05-08T18:03:15.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:35:43.687-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0703 An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0704

2019-04-08T20:29:00.933-04:00

2019-04-09T14:55:45.793-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:30:04.367-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0704 An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0703, CVE-2019-0821.

CVE-2019-0707

2019-05-16T15:29:00.347-04:00

2019-05-21T10:06:32.697-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T09:30:30.287-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0707 An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level, aka 'Windows NDIS Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2003:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2003:-:sp2:~~~~x86~ cpe:/o:microsoft:windows_server_2003:r2:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_vista:-:sp2 cpe:/o:microsoft:windows_xp:-:sp2:~~professional~~x64~ cpe:/o:microsoft:windows_xp:-:sp3:~~~~x86~

CVE-2019-0708

2019-05-16T15:29:00.427-04:00

2019-07-15T13:15:12.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html MISC http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html MISC http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html CONFIRM http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en CONFIRM http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf CONFIRM https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

CVE-2019-0709

2019-06-12T10:29:01.150-04:00

2019-06-12T15:58:57.193-04:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:19:36.733-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0709 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0620, CVE-2019-0722.

CVE-2019-0710

2019-06-12T10:29:01.180-04:00

2019-06-12T16:06:33.730-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:16:18.827-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0710 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0711, CVE-2019-0713.

CVE-2019-0711

2019-06-12T10:29:01.213-04:00

2019-06-12T16:12:02.893-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:14:42.477-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0711 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0710, CVE-2019-0713.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0713

2019-06-12T10:29:01.257-04:00

2019-06-12T16:22:38.387-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:08:28.963-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0713 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0710, CVE-2019-0711.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0714

2019-08-14T17:15:12.547-04:00

2019-08-20T11:08:00.053-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T12:02:46.643-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0714 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0715, CVE-2019-0717, CVE-2019-0718, CVE-2019-0723.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0715

2019-08-14T17:15:12.640-04:00

2019-08-20T11:00:10.110-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T12:01:03.513-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0715 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0717, CVE-2019-0718, CVE-2019-0723.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0716

2019-08-14T17:15:12.720-04:00

2019-08-19T12:55:54.750-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T12:07:03.593-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0716 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0717

2019-08-14T17:15:12.783-04:00

2019-08-20T10:42:11.733-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T11:56:29.923-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0717 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0718, CVE-2019-0723.

CVE-2019-0718

2019-08-14T17:15:12.860-04:00

2019-08-20T10:29:40.090-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T11:54:43.327-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0718 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0717, CVE-2019-0723.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0720

2019-08-14T17:15:12.953-04:00

2019-08-20T13:23:05.467-04:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-08-20T08:49:26.940-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0720 A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0722

2019-06-12T10:29:01.307-04:00

2019-06-12T16:26:14.307-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-06-12T14:09:15.237-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0722 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0620, CVE-2019-0709.

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_7:-:sp1:~~~~x64~ cpe:/o:microsoft:windows_8.1:-::~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0723

2019-08-14T17:15:13.033-04:00

2019-08-20T10:35:29.590-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-08-19T11:55:40.857-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0723 A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0714, CVE-2019-0715, CVE-2019-0717, CVE-2019-0718.

CVE-2019-0724

2019-03-05T18:29:02.677-05:00

2019-03-06T13:47:48.057-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-03-06T10:57:47.450-05:00

BID 106906 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0724 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.

cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0725

2019-05-16T15:29:00.490-04:00

2019-05-16T17:49:44.120-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-16T16:17:32.380-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725 A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019

CVE-2019-0726

2019-04-08T20:29:00.980-04:00

2019-04-09T23:45:28.123-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T11:26:18.143-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0726 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0698.

cpe:/a:microsoft:visual_studio:2015:3 cpe:/a:microsoft:visual_studio_2017:15.0 cpe:/a:microsoft:visual_studio_2017:15.9 cpe:/a:microsoft:visual_studio_2019:16.0 cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0727

2019-05-16T15:29:00.537-04:00

2019-05-20T14:35:31.930-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T13:50:28.387-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0727 An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:visual_studio_code:-

CVE-2019-0728

2019-03-05T18:29:02.707-05:00

2019-05-03T08:06:47.327-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-02T10:59:28.223-04:00

FULLDISC 20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients MLIST [oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients) BID 106913 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0728 A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.

cpe:/a:microsoft:java_software_development_kit:-::~~~azure_internet_of_things~~

CVE-2019-0729

2019-03-05T18:29:02.740-05:00

2019-03-12T15:57:40.447-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-07T08:27:57.267-05:00

BID 106966 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729 An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0730

2019-04-09T17:29:00.363-04:00

2019-05-08T18:11:29.680-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-17T10:09:08.250-04:00

MISC http://packetstormsecurity.com/files/152533/Microsoft-Windows-LUAFV-Delayed-Virtualization-MAXIMUM_ACCESS-DesiredAccess-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0730 EXPLOIT-DB 46713 An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0731

2019-04-09T17:29:00.397-04:00

2019-05-08T18:11:29.680-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-17T10:08:47.390-04:00

MISC http://packetstormsecurity.com/files/152534/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cross-Process-Handle-Duplication-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0731 EXPLOIT-DB 46714 An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0732

2019-04-09T17:29:00.427-04:00

2019-04-17T13:31:56.337-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-17T10:04:59.150-04:00

MISC http://packetstormsecurity.com/files/152536/Microsoft-Windows-LUAFV-NtSetCachedSigningLevel-Device-Guard-Bypass.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0732 EXPLOIT-DB 46716 A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Security Feature Bypass Vulnerability'.

CVE-2019-0733

2019-05-16T15:29:00.613-04:00

2019-05-21T09:56:58.327-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-18T13:35:23.100-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0733 A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019

CVE-2019-0734

2019-05-16T15:29:00.677-04:00

2019-05-20T12:14:16.287-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T09:15:51.517-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0734 An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and replace authentication request using Kerberos, allowing an attacker to be validated as an Administrator.The update addresses this vulnerability by changing how these requests are validated., aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0936.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0735

2019-04-09T17:29:00.473-04:00

2019-04-17T13:19:42.183-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-17T10:01:46.630-04:00

MISC http://packetstormsecurity.com/files/152532/Microsoft-Windows-CSRSS-SxSSrv-Cached-Manifest-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0735 EXPLOIT-DB 46712 An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windows CSRSS Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803

CVE-2019-0736

2019-08-14T17:15:13.097-04:00

2019-08-19T15:17:47.750-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-19T13:15:09.200-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0736 A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'.

CVE-2019-0739

2019-04-09T17:29:00.520-04:00

2019-04-10T13:49:42.850-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:36:14.537-04:00

BID 107708 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0739 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0752, CVE-2019-0753, CVE-2019-0862.

cpe:/a:microsoft:java_software_development_kit:-::~~~azure_internet_of_things~~

CVE-2019-0741

2019-03-05T18:29:02.770-05:00

2019-03-08T12:40:14.690-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-07T08:19:14.430-05:00

BID 106971 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0741 An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.

cpe:/a:microsoft:team_foundation_server:2018:3.2

CVE-2019-0742

2019-03-05T18:29:02.803-05:00

2019-03-08T09:23:03.143-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-07T22:59:24.997-05:00

BID 106967 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0742 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0743.

cpe:/a:microsoft:team_foundation_server:2018:3.2

CVE-2019-0743

2019-03-05T18:29:02.850-05:00

2019-03-08T09:21:27.063-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-07T22:56:17.040-05:00

BID 106970 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0743 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742.

cpe:/a:microsoft:chakracore:- cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0746

2019-04-08T20:29:01.027-04:00

2019-05-08T18:03:15.643-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:09:03.067-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0746 An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'.

cpe:/a:microsoft:office:2010:sp2

CVE-2019-0748

2019-04-08T20:29:01.060-04:00

2019-04-09T12:23:42.390-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T11:01:12.720-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0748 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0752

2019-04-09T17:29:00.567-04:00

2019-05-28T13:29:00.540-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.316-Memory-Corruption.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0752 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-359/ A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0753

2019-04-09T17:29:00.597-04:00

2019-04-10T13:49:21.210-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:23:46.593-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0753 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0752, CVE-2019-0862.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2::~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2::~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0754

2019-04-08T20:29:01.090-04:00

2019-05-08T18:03:15.643-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T10:59:06.260-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0754 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0755

2019-04-08T20:29:01.137-04:00

2019-06-24T21:15:10.173-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153407/Microsoft-Windows-CmpAddRemoveContainerToCLFSLog-Arbitrary-File-Directory-Creation.html MISC http://packetstormsecurity.com/files/153408/Microsoft-Windows-Font-Cache-Service-Insecure-Sections.html CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0755 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0756

2019-04-08T22:29:00.570-04:00

2019-04-09T23:37:52.207-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T12:25:16.847-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0756 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.

cpe:/a:microsoft:.net_core_sdk:1.1 cpe:/a:microsoft:.net_core_sdk:2.1.500 cpe:/a:microsoft:.net_core_sdk:2.2.100 cpe:/a:microsoft:nuget:4.3.1 cpe:/a:microsoft:nuget:4.4.2 cpe:/a:microsoft:nuget:4.5.2 cpe:/a:microsoft:nuget:4.6.3 cpe:/a:microsoft:nuget:4.7.2 cpe:/a:microsoft:nuget:4.8.2 cpe:/a:microsoft:nuget:4.9.4 cpe:/a:microsoft:visual_studio_2017:- cpe:/a:mono-project:mono_framework:5.18.0.223 cpe:/a:mono-project:mono_framework:5.20.0

CVE-2019-0757

2019-04-08T22:29:00.600-04:00

2019-05-22T09:29:00.583-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2019:1259 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0757 A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet package's folder structure, aka 'NuGet Package Manager Tampering Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019

CVE-2019-0758

2019-05-16T15:29:00.740-04:00

2019-05-20T11:23:55.690-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T09:14:18.437-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0758 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0882, CVE-2019-0961.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0759

2019-04-08T22:29:00.647-04:00

2019-04-11T11:11:08.507-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T12:11:01.193-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0759 An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows Print Spooler Information Disclosure Vulnerability'.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0761

2019-04-08T22:29:00.710-04:00

2019-04-09T14:45:30.610-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:56:05.243-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0761 A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific URLs, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0768.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0762

2019-04-08T22:29:00.740-04:00

2019-04-09T14:39:55.180-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T11:49:22.610-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0762 A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0763

2019-04-08T22:29:00.787-04:00

2019-04-09T14:28:32.453-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T11:43:28.040-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0763 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0764

2019-04-09T17:29:00.630-04:00

2019-04-11T10:09:52.773-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T14:20:08.843-04:00

BID 107731 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0764 A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0765

2019-04-08T22:29:00.820-04:00

2019-04-10T13:37:38.930-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T11:39:04.080-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0765 A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vulnerability'.

CVE-2019-0766

2019-04-08T22:29:00.850-04:00

2019-04-09T13:12:38.800-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T11:35:22.077-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0766 An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0767

2019-04-08T22:29:00.897-04:00

2019-04-10T09:58:46.870-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:24:55.620-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0767 An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0775, CVE-2019-0782.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0768

2019-04-08T22:29:00.927-04:00

2019-04-09T14:47:23.080-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:21:18.050-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768 A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0761.

CVE-2019-0769

2019-04-08T22:29:00.960-04:00

2019-04-09T15:57:53.870-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:19:08.810-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0769 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

cpe:/a:microsoft:edge:-

CVE-2019-0770

2019-04-08T23:29:00.217-04:00

2019-04-09T14:26:41.890-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:18:24.747-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0770 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.

CVE-2019-0771

2019-04-08T23:29:00.263-04:00

2019-04-09T14:18:16.400-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:17:09.070-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0771 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0773, CVE-2019-0783.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0772

2019-04-08T23:29:00.310-04:00

2019-04-09T14:16:29.460-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:14:34.497-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0772 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0666, CVE-2019-0667.

CVE-2019-0773

2019-04-08T23:29:00.357-04:00

2019-04-10T09:46:37.603-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:07:43.663-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0773 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0783.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0774

2019-04-08T23:29:00.390-04:00

2019-04-09T16:07:29.477-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:03:44.433-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0774 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0614.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0775

2019-04-08T23:29:00.420-04:00

2019-04-09T13:04:56.237-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T12:46:00.323-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0775 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0782.

CVE-2019-0776

2019-04-08T23:29:00.467-04:00

2019-04-09T13:01:25.570-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T12:42:09.943-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0776 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2

CVE-2019-0777

2019-04-08T23:29:00.497-04:00

2019-04-09T15:23:39.383-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:54:57.260-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0777 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0778

2019-04-08T23:29:00.547-04:00

2019-04-09T15:33:04.553-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:53:24.883-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0778 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

cpe:/a:microsoft:edge:-

CVE-2019-0779

2019-04-08T23:29:00.577-04:00

2019-04-09T15:51:51.987-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:50:41.583-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0779 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0780

2019-04-08T23:29:00.607-04:00

2019-04-09T23:24:38.123-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:49:17.147-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0780 A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0782

2019-04-08T23:29:00.657-04:00

2019-04-09T14:49:25.003-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:36:52.423-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0782 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0775.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0783

2019-04-08T23:29:00.687-04:00

2019-04-09T14:49:08.473-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:29:03.817-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0783 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0784

2019-04-08T23:29:00.717-04:00

2019-04-10T11:54:01.657-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:47:04.330-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0784 A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, aka 'Windows ActiveX Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0785

2019-07-15T15:15:15.403-04:00

2019-07-19T11:54:45.530-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-16T14:27:38.717-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0785 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.

CVE-2019-0786

2019-04-09T17:29:00.660-04:00

2019-04-11T09:56:17.817-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T14:05:37.027-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0786 An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a specially crafted file over the SMB protocol on the same machine, aka 'SMB Server Elevation of Privilege Vulnerability'.

CVE-2019-0787

2019-09-11T18:15:13.663-04:00

2019-09-12T10:11:40.370-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-09-12T09:06:51.023-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0787 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0788, CVE-2019-1290, CVE-2019-1291.

CVE-2019-0788

2019-09-11T18:15:13.790-04:00

2019-09-12T09:57:12.237-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-09-12T09:04:18.690-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0788 A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0787, CVE-2019-1290, CVE-2019-1291.

CVE-2019-0790

2019-04-09T17:29:00.707-04:00

2019-04-10T21:29:48.587-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T21:31:28.637-04:00

BID 107702 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0790 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0791, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0791

2019-04-09T17:29:00.740-04:00

2019-04-10T21:31:27.247-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:15:23.013-04:00

BID 107726 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0791 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0792, CVE-2019-0793, CVE-2019-0795.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0792

2019-04-09T17:29:00.770-04:00

2019-04-10T21:31:24.683-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:14:02.997-04:00

BID 107728 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0792 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0793, CVE-2019-0795.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0793

2019-04-09T17:29:00.800-04:00

2019-04-10T21:31:21.903-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:12:20.193-04:00

BID 107729 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0793 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0795.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0794

2019-04-09T17:29:00.833-04:00

2019-04-11T09:58:34.820-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:10:30.627-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0794 A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0795

2019-04-09T17:29:00.897-04:00

2019-04-11T10:02:22.560-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:03:34.677-04:00

BID 107732 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0795 A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0790, CVE-2019-0791, CVE-2019-0792, CVE-2019-0793.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0796

2019-04-09T17:29:00.927-04:00

2019-05-08T18:11:29.680-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-17T09:43:54.823-04:00

MISC http://packetstormsecurity.com/files/152535/Microsoft-Windows-LUAFV-LuafvCopyShortName-Arbitrary-Short-Name-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0796 EXPLOIT-DB 46715 An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0805, CVE-2019-0836, CVE-2019-0841.

CVE-2019-0797

2019-04-08T23:29:00.763-04:00

2019-05-08T18:03:15.643-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T17:19:58.320-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.

cpe:/a:microsoft:lync_server:2013 cpe:/a:microsoft:skype_for_business_server:2015

CVE-2019-0798

2019-04-08T23:29:00.810-04:00

2019-04-09T14:27:14.107-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:40:59.820-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0798 A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.

CVE-2019-0801

2019-04-09T17:29:00.957-04:00

2019-04-15T08:31:29.257-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0801 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-358/ A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have to convince a user to open a specially crafted URL file that points to an Excel or PowerPoint file that was also downloaded.The update addresses the vulnerability by correcting how Office handles these files., aka 'Office Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0802

2019-04-09T17:29:00.990-04:00

2019-04-10T16:57:08.293-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T12:41:06.357-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0802 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0849.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0803

2019-04-09T17:29:01.037-04:00

2019-05-23T14:29:01.327-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153034/Microsoft-Windows-Win32k-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.

cpe:/a:microsoft:walinuxagent:2.2.0 cpe:/a:microsoft:walinuxagent:2.2.1 cpe:/a:microsoft:walinuxagent:2.2.2 cpe:/a:microsoft:walinuxagent:2.2.3 cpe:/a:microsoft:walinuxagent:2.2.4 cpe:/a:microsoft:walinuxagent:2.2.5 cpe:/a:microsoft:walinuxagent:2.2.6 cpe:/a:microsoft:walinuxagent:2.2.7 cpe:/a:microsoft:walinuxagent:2.2.8 cpe:/a:microsoft:walinuxagent:2.2.9 cpe:/a:microsoft:walinuxagent:2.2.10 cpe:/a:microsoft:walinuxagent:2.2.11 cpe:/a:microsoft:walinuxagent:2.2.12 cpe:/a:microsoft:walinuxagent:2.2.13 cpe:/a:microsoft:walinuxagent:2.2.14 cpe:/a:microsoft:walinuxagent:2.2.15 cpe:/a:microsoft:walinuxagent:2.2.16 cpe:/a:microsoft:walinuxagent:2.2.17 cpe:/a:microsoft:walinuxagent:2.2.18 cpe:/a:microsoft:walinuxagent:2.2.19 cpe:/a:microsoft:walinuxagent:2.2.20 cpe:/a:microsoft:walinuxagent:2.2.25 cpe:/a:microsoft:walinuxagent:2.2.26 cpe:/a:microsoft:walinuxagent:2.2.31 cpe:/a:microsoft:walinuxagent:2.2.32 cpe:/a:microsoft:walinuxagent:2.2.33 cpe:/a:microsoft:walinuxagent:2.2.34 cpe:/a:microsoft:walinuxagent:2.2.35 cpe:/a:microsoft:walinuxagent:2.2.36 cpe:/a:microsoft:walinuxagent:2.2.37

CVE-2019-0804

2019-04-08T23:29:00.843-04:00

2019-06-18T17:15:10.683-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2019:1527 CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0804 An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0805

2019-04-09T17:29:01.067-04:00

2019-05-08T18:11:29.680-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-17T09:41:29.830-04:00

MISC http://packetstormsecurity.com/files/152537/Microsoft-Windows-LUAFV-Delayed-Virtualization-Cache-Manager-Poisoning-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0805 EXPLOIT-DB 46717 An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0836, CVE-2019-0841.

CVE-2019-0806

2019-04-09T17:29:01.097-04:00

2019-04-10T12:30:22.453-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T12:13:05.370-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0806 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.

cpe:/o:microsoft:windows_7:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0808

2019-04-08T23:29:00.873-04:00

2019-04-09T17:18:20.477-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-09T13:53:20.400-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.

cpe:/a:microsoft:visual_studio_2017:15.9

CVE-2019-0809

2019-04-08T23:29:00.907-04:00

2019-04-09T23:01:20.203-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-09T14:02:18.990-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0809 A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files, aka 'Visual Studio Remote Code Execution Vulnerability'.

CVE-2019-0810

2019-04-09T17:29:01.130-04:00

2019-04-15T08:31:29.307-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0810 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-361/ A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.

cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0811

2019-07-15T15:15:15.497-04:00

2019-07-19T09:55:12.017-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-16T08:35:12.397-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0811 A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerability'.

CVE-2019-0812

2019-04-09T17:29:01.160-04:00

2019-04-10T12:16:14.717-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:53:21.923-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0812 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.

CVE-2019-0813

2019-04-09T17:29:01.193-04:00

2019-04-11T11:33:30.857-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T11:18:02.237-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0813 An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center Elevation of Privilege Vulnerability'.

CVE-2019-0814

2019-04-09T17:29:01.223-04:00

2019-04-11T11:01:48.997-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T11:13:19.777-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0814 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0848.

cpe:/a:microsoft:asp.net_core:2.2

CVE-2019-0815

2019-04-09T17:29:01.270-04:00

2019-04-10T13:11:32.537-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T11:09:20.267-04:00

BID 107701 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0815 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

CVE-2019-0816

2019-04-08T23:29:00.937-04:00

2019-04-10T14:11:13.580-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:44:09.437-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816 A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.

cpe:/a:microsoft:exchange_server:2010:sp3 cpe:/a:microsoft:exchange_server:2013:cumulative_update_22 cpe:/a:microsoft:exchange_server:2016:cumulative_update_11 cpe:/a:microsoft:exchange_server:2016:cumulative_update_12 cpe:/a:microsoft:exchange_server:2019 cpe:/a:microsoft:exchange_server:2019:cumulative_update_1

CVE-2019-0817

2019-04-09T17:29:01.300-04:00

2019-04-11T10:42:13.987-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T11:07:46.767-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0817 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0858.

cpe:/a:microsoft:sql_server:2017

CVE-2019-0819

2019-05-16T15:29:00.803-04:00

2019-05-20T11:21:39.563-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T09:09:47.213-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0819 An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka 'Microsoft SQL Server Analysis Services Information Disclosure Vulnerability'.

cpe:/a:microsoft:.net_core:1.0 cpe:/a:microsoft:.net_core:1.1 cpe:/a:microsoft:.net_core:2.1 cpe:/a:microsoft:.net_core:2.2 cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1 cpe:/a:microsoft:.net_framework:4.6.2 cpe:/a:microsoft:.net_framework:4.7 cpe:/a:microsoft:.net_framework:4.7.1 cpe:/a:microsoft:.net_framework:4.7.2 cpe:/a:microsoft:.net_framework:4.8

CVE-2019-0820

2019-05-16T15:29:00.880-04:00

2019-05-22T09:29:00.727-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2019:1259 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0820 A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0821

2019-04-08T23:29:00.967-04:00

2019-04-09T14:46:24.423-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-09T13:38:47.113-04:00

CONFIRM https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0821 An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0703, CVE-2019-0704.

cpe:/a:microsoft:office:2016::~~~mac_os_x~~ cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office:2019::~~~mac_os_x~~ cpe:/a:microsoft:office_365_proplus

CVE-2019-0822

2019-04-09T17:29:01.347-04:00

2019-04-10T12:17:20.327-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:03:15.803-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0822 A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'.

cpe:/a:microsoft:office:2010:sp2

CVE-2019-0823

2019-04-09T17:29:01.380-04:00

2019-04-10T11:31:00.267-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T10:44:10.693-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0823 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0824, CVE-2019-0825, CVE-2019-0826, CVE-2019-0827.

CVE-2019-0824

2019-04-09T17:29:01.427-04:00

2019-04-10T11:30:37.597-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T10:42:51.923-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0824 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0825, CVE-2019-0826, CVE-2019-0827.

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2016 cpe:/a:microsoft:office:2019 cpe:/a:microsoft:office_365_proplus

CVE-2019-0825

2019-04-09T17:29:01.473-04:00

2019-04-10T11:30:16.283-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T10:41:37.603-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0825 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0826, CVE-2019-0827.

CVE-2019-0826

2019-04-09T17:29:01.520-04:00

2019-04-10T11:29:28.453-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T10:40:50.033-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0826 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0825, CVE-2019-0827.

CVE-2019-0827

2019-04-09T17:29:01.550-04:00

2019-04-10T11:29:54.440-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-10T10:35:30.327-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0827 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823, CVE-2019-0824, CVE-2019-0825, CVE-2019-0826.

cpe:/a:microsoft:excel:2010:sp2 cpe:/a:microsoft:excel:2013:sp1 cpe:/a:microsoft:excel:2013:sp1:~~rt~~~ cpe:/a:microsoft:excel:2016 cpe:/a:microsoft:excel:2016::~~~mac_os_x~~ cpe:/a:microsoft:excel:2019 cpe:/a:microsoft:excel:2019::~~~mac_os_x~~ cpe:/a:microsoft:office_365_proplus:-

CVE-2019-0828

2019-04-09T17:29:01.583-04:00

2019-04-10T10:48:19.590-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T10:21:19.447-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0828 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

CVE-2019-0829

2019-04-09T17:29:01.613-04:00

2019-04-10T11:53:24.203-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:51:28.593-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0829 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0860, CVE-2019-0861.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0830

2019-04-09T17:29:01.660-04:00

2019-04-10T10:33:25.100-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T10:01:50.887-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0830 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831.

cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1 cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2010:sp2 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0831

2019-04-09T17:29:01.693-04:00

2019-04-10T10:15:07.860-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T10:00:14.620-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0831 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.

cpe:/a:microsoft:edge:-

CVE-2019-0833

2019-04-09T17:29:01.740-04:00

2019-04-10T10:23:52.090-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T09:56:16.023-04:00

BID 107704 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0833 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerability'.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0835

2019-04-09T17:29:01.770-04:00

2019-04-10T10:01:14.950-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T09:54:27.910-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835 An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scripting Engine Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0836

2019-04-09T17:29:01.800-04:00

2019-05-08T18:11:29.680-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-17T09:07:30.573-04:00

MISC http://packetstormsecurity.com/files/152538/Microsoft-Windows-LUAFV-PostLuafvPostReadWrite-SECTION_OBJECT_POINTERS-Race-Condition.html BID 107719 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0836 EXPLOIT-DB 46718 An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0841.

cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803

CVE-2019-0837

2019-04-09T17:29:01.833-04:00

2019-04-10T09:49:34.297-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T09:36:11.683-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0837 An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:-::~~pro_n~~~ cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0838

2019-04-09T17:29:01.880-04:00

2019-05-08T18:11:29.680-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T09:21:43.447-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0838 An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0839.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~x64~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0839

2019-04-09T17:29:01.927-04:00

2019-05-08T18:03:15.643-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T08:57:06.693-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0839 An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0838.

CVE-2019-0840

2019-04-09T17:29:01.957-04:00

2019-04-10T14:44:02.420-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T12:01:47.307-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0840 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0844.

CVE-2019-0841

2019-04-09T17:29:01.990-04:00

2019-06-07T13:29:00.867-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html MISC http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html MISC http://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html MISC http://packetstormsecurity.com/files/153215/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html MISC http://packetstormsecurity.com/files/153642/AppXSvc-Hard-Link-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0841 EXPLOIT-DB 46683 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-360/ An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0842

2019-04-09T17:29:02.020-04:00

2019-04-10T14:30:07.217-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:58:40.633-04:00

BID 107725 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0842 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0844

2019-04-09T17:29:02.050-04:00

2019-04-10T14:42:29.590-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T11:59:52.353-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0844 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0840.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~x64~~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0845

2019-04-09T17:29:02.083-04:00

2019-05-08T18:03:15.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T13:45:08.127-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0845 A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0846

2019-04-09T17:29:02.147-04:00

2019-04-10T13:23:47.813-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:30:56.973-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0846 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0847, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0847

2019-04-09T17:29:02.193-04:00

2019-04-10T13:26:12.410-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:30:19.847-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0847 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0851, CVE-2019-0877, CVE-2019-0879.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0848

2019-04-09T17:29:02.223-04:00

2019-04-10T14:00:57.177-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T11:38:20.043-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0848 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0814.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0849

2019-04-09T17:29:02.270-04:00

2019-04-10T12:46:17.333-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T11:36:37.120-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0849 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0802.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0851

2019-04-09T17:29:02.300-04:00

2019-04-10T13:17:57.083-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:29:14.487-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0851 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0877, CVE-2019-0879.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0853

2019-04-09T17:29:02.333-04:00

2019-04-15T08:31:29.477-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0853 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-362/ MISC https://www.zerodayinitiative.com/advisories/ZDI-19-363/ A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0856

2019-04-09T17:29:02.363-04:00

2019-04-10T14:07:30.013-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:25:47.433-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0856 A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.

cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0857

2019-04-09T17:29:02.427-04:00

2019-04-11T07:55:48.997-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T15:01:19.257-04:00

BID 107760 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0857 A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'.

cpe:/a:microsoft:exchange_server:2013:cumulative_update_22 cpe:/a:microsoft:exchange_server:2016:cumulative_update_11 cpe:/a:microsoft:exchange_server:2016:cumulative_update_12 cpe:/a:microsoft:exchange_server:2019 cpe:/a:microsoft:exchange_server:2019:cumulative_update_1

CVE-2019-0858

2019-04-09T17:29:02.473-04:00

2019-04-10T21:50:42.560-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T16:42:08.133-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0858 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0817.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0859

2019-04-09T17:29:02.520-04:00

2019-04-10T14:27:06.603-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:54:41.940-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.

CVE-2019-0860

2019-04-09T17:29:02.567-04:00

2019-04-10T12:14:05.777-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:47:53.667-04:00

BID 107722 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0860 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0861.

CVE-2019-0861

2019-04-09T17:29:02.613-04:00

2019-04-10T12:09:32.973-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:45:45.210-04:00

BID 107724 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0861 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0862

2019-04-09T17:29:02.660-04:00

2019-04-10T13:48:04.567-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T11:43:09.503-04:00

BID 107727 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0862 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0752, CVE-2019-0753.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0863

2019-05-16T15:29:00.927-04:00

2019-05-24T12:29:00.377-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/153008/Angry-Polar-Bear-2-Microsoft-Windows-Error-Reporting-Local-Privilege-Escalation.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0863 An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.

CVE-2019-0864

2019-05-16T15:29:00.990-04:00

2019-05-20T12:08:52.733-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-18T10:28:25.647-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0864 A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0865

2019-07-15T15:15:15.593-04:00

2019-07-22T13:27:42.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-17T12:56:45.020-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0865 A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by creating a specially crafted connection or message.The security update addresses the vulnerability by correcting the way SymCrypt handles digital signatures., aka 'SymCrypt Denial of Service Vulnerability'.

cpe:/a:microsoft:team_foundation_server:2015:4.2 cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0866

2019-04-09T17:29:02.707-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:48:18.740-04:00

BID 107749 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.

cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0867

2019-04-09T17:29:02.757-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:17:05.737-04:00

BID 107752 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0867 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0868

2019-04-09T17:29:02.817-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:15:59.233-04:00

BID 107753 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0868 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0870, CVE-2019-0871.

cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0869

2019-04-09T17:29:02.863-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T14:06:58.200-04:00

BID 107768 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0869 A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0870

2019-04-09T17:29:02.927-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:21:19.713-04:00

BID 107754 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0870 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0871.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0871

2019-04-09T17:29:02.957-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:10:38.970-04:00

BID 107755 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0871 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0866, CVE-2019-0867, CVE-2019-0868, CVE-2019-0870.

CVE-2019-0872

2019-05-16T15:29:01.067-04:00

2019-07-16T10:42:23.800-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T09:08:02.507-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0872 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.

cpe:/o:microsoft:azure_devops_server

CVE-2019-0874

2019-04-09T17:29:03.007-04:00

2019-07-16T10:42:21.550-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T13:13:10.743-04:00

BID 107759 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0874 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.

cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0875

2019-04-09T17:29:03.053-04:00

2019-07-16T10:42:23.800-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-10T14:22:01.173-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0875 An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOps Server Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:open_enclave_software_development_kit:0.1.0 cpe:/a:microsoft:open_enclave_software_development_kit:0.4.0 cpe:/a:microsoft:open_enclave_software_development_kit:0.4.1

CVE-2019-0876

2019-04-09T17:29:03.113-04:00

2019-04-11T12:23:31.113-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-11T10:03:00.623-04:00

BID 107743 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0876 An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~x64~~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0877

2019-04-09T17:29:03.223-04:00

2019-05-08T18:03:15.923-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T16:04:07.567-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0877 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0879.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~x64~~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0879

2019-04-09T17:29:03.270-04:00

2019-05-08T18:03:15.923-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-04-10T14:56:29.593-04:00

BID 107741 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0879 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0877.

CVE-2019-0880

2019-07-15T15:15:15.687-04:00

2019-07-16T21:36:51.543-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-16T13:52:44.933-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880 A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0881

2019-05-16T15:29:01.147-04:00

2019-05-21T22:29:00.233-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152988/Microsoft-Windows-CmKeyBodyRemapToVirtualForEnum-Arbitrary-Key-Enumeration.html MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0881 An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0882

2019-05-16T15:29:01.193-04:00

2019-05-17T15:09:23.147-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T14:52:41.837-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0882 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0961.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0884

2019-05-16T15:29:01.257-04:00

2019-09-27T12:41:20.163-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-09-27T12:12:18.820-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0884 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0911, CVE-2019-0918.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0885

2019-05-16T15:29:01.317-04:00

2019-05-17T14:00:45.213-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T13:33:29.357-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0885 A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0886

2019-05-16T15:29:01.380-04:00

2019-05-17T13:53:42.830-04:00

2.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T13:15:40.450-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0886 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0887

2019-07-15T15:15:15.797-04:00

2019-08-08T13:15:10.547-04:00

8.5

NETWORK

MEDIUM

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 108964 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0887 MISC https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/ MISC https://research.checkpoint.com/reverse-rdp-the-hyper-v-connection/ A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0888

2019-06-12T10:29:01.337-04:00

2019-06-12T14:49:59.330-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:42:11.087-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0888 A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory, aka 'ActiveX Data Objects (ADO) Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0889

2019-05-16T15:29:01.443-04:00

2019-05-17T13:09:21.457-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:13:31.957-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0889 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0890

2019-05-16T15:29:01.490-04:00

2019-05-17T13:08:54.393-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:13:52.363-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0890 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0891

2019-05-16T15:29:01.553-04:00

2019-05-17T12:53:30.307-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:15:12.950-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0891 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:1709 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0892

2019-05-16T15:29:01.613-04:00

2019-05-17T13:51:58.217-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T13:25:46.590-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0892 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0893

2019-05-16T15:29:01.660-04:00

2019-05-17T12:51:49.663-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:14:58.120-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0893 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0894

2019-05-16T15:29:01.740-04:00

2019-05-17T12:41:21.083-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:50:01.947-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0894 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0895

2019-05-16T15:29:01.803-04:00

2019-05-17T12:35:08.350-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:49:11.603-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0895 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0896

2019-05-16T15:29:01.863-04:00

2019-05-17T12:24:10.493-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:48:11.010-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0896 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0897

2019-05-16T15:29:01.910-04:00

2019-05-17T12:21:31.600-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:47:08.290-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0897 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0898

2019-05-16T15:29:01.990-04:00

2019-05-17T12:20:12.247-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:46:36.900-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0898 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0899

2019-05-16T15:29:02.053-04:00

2019-05-17T12:19:32.277-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:45:47.557-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0899 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0900, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0900

2019-05-16T15:29:02.113-04:00

2019-05-17T12:18:49.550-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:44:25.650-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0900 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0901, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0901

2019-05-16T15:29:02.177-04:00

2019-05-17T12:18:52.520-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:43:25.853-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0901 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0902.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0902

2019-05-16T15:29:02.240-04:00

2019-05-17T12:03:20.867-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:38:33.567-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0902 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889, CVE-2019-0890, CVE-2019-0891, CVE-2019-0893, CVE-2019-0894, CVE-2019-0895, CVE-2019-0896, CVE-2019-0897, CVE-2019-0898, CVE-2019-0899, CVE-2019-0900, CVE-2019-0901.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0903

2019-05-16T15:29:02.303-04:00

2019-05-16T17:45:36.847-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-16T15:59:57.297-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0903 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0904

2019-06-12T10:29:01.367-04:00

2019-06-12T13:58:27.290-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:35:21.457-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0904 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0905

2019-06-12T10:29:01.417-04:00

2019-06-12T14:03:54.907-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:40:01.477-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0905 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0906

2019-06-12T10:29:01.463-04:00

2019-07-02T17:15:10.727-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0906 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-624/ A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0907

2019-06-12T10:29:01.507-04:00

2019-06-12T14:08:17.867-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:38:28.553-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0907 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0908, CVE-2019-0909, CVE-2019-0974.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0908

2019-06-12T10:29:01.557-04:00

2019-06-12T14:11:09.313-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:37:44.863-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0908 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0909, CVE-2019-0974.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0909

2019-06-12T10:29:01.587-04:00

2019-06-12T14:18:10.197-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:36:36.753-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0909 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0974.

CVE-2019-0911

2019-05-16T15:29:02.347-04:00

2019-05-16T18:01:48.527-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-16T17:04:12.607-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0911 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0918.

CVE-2019-0912

2019-05-16T15:29:02.410-04:00

2019-05-17T11:59:23.347-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:39:39.237-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0912 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0913

2019-05-16T15:29:02.490-04:00

2019-05-17T11:53:11.167-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:39:14.113-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0913 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0914

2019-05-16T15:29:02.553-04:00

2019-05-17T11:45:45.040-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T11:40:04.317-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0914 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0915

2019-05-16T15:29:02.613-04:00

2019-05-17T12:57:04.000-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:32:58.827-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0915 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0916

2019-05-16T15:29:02.677-04:00

2019-05-17T13:09:45.817-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:30:54.383-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0916 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0917

2019-05-16T15:29:02.770-04:00

2019-05-17T12:52:53.760-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:28:06.230-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0917 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0918

2019-05-16T15:29:02.833-04:00

2019-05-17T14:51:30.770-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T14:42:42.127-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0918 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0911.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10:- cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0920

2019-06-12T10:29:01.633-04:00

2019-07-04T14:15:10.003-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0920 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-625/ MISC https://www.zerodayinitiative.com/advisories/ZDI-19-626/ MISC https://www.zerodayinitiative.com/advisories/ZDI-19-627/ MISC https://www.zerodayinitiative.com/advisories/ZDI-19-638/ MISC https://www.zerodayinitiative.com/advisories/ZDI-19-639/ A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0988, CVE-2019-1005, CVE-2019-1055, CVE-2019-1080.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0921

2019-05-16T15:29:02.897-04:00

2019-05-20T15:01:00.577-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T10:54:12.623-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0921 An spoofing vulnerability exists when Internet Explorer improperly handles URLs, aka 'Internet Explorer Spoofing Vulnerability'.

CVE-2019-0922

2019-05-16T15:29:02.957-04:00

2019-05-17T12:52:07.727-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:25:55.110-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0922 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

cpe:/a:microsoft:edge:-

CVE-2019-0923

2019-05-16T15:29:03.020-04:00

2019-05-17T12:46:16.607-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:23:25.410-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0923 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0924

2019-05-16T15:29:03.067-04:00

2019-05-17T12:48:34.347-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:09:52.060-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0924 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0925

2019-05-16T15:29:03.160-04:00

2019-05-17T12:45:07.997-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:09:10.480-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0925 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.

cpe:/a:microsoft:edge:-

CVE-2019-0926

2019-05-16T15:29:03.223-04:00

2019-05-20T14:16:01.747-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T13:42:09.733-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0926 A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'.

CVE-2019-0927

2019-05-16T15:29:03.287-04:00

2019-05-17T12:43:31.027-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:08:27.247-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0927 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0933, CVE-2019-0937.

CVE-2019-0928

2019-09-11T18:15:13.867-04:00

2019-09-12T16:15:29.850-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-09-12T12:44:10.473-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0928 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0929

2019-05-16T15:29:03.350-04:00

2019-05-20T14:36:33.230-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T13:41:06.780-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0929 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0930

2019-05-16T15:29:03.397-04:00

2019-05-20T09:19:51.387-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T11:07:25.593-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0930 An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0931

2019-05-16T15:29:03.457-04:00

2019-05-20T09:29:12.757-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T11:02:22.273-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0931 An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:skype:8.35::~~~android~~

CVE-2019-0932

2019-05-16T15:29:03.507-04:00

2019-05-20T09:36:01.330-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T10:21:09.773-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0932 An information disclosure vulnerability exists in Skype for Android, aka 'Skype for Android Information Disclosure Vulnerability'.

CVE-2019-0933

2019-05-16T15:29:03.567-04:00

2019-05-17T12:43:20.527-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:07:26.387-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0933 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0937.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0936

2019-05-16T15:29:03.647-04:00

2019-05-20T09:48:02.040-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T10:34:26.773-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0936 An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0734.

CVE-2019-0937

2019-05-16T15:29:03.693-04:00

2019-05-17T12:21:46.837-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T12:05:47.260-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0937 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933.

cpe:/a:microsoft:edge:-

CVE-2019-0938

2019-05-16T15:29:03.757-04:00

2019-05-20T14:29:48.740-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-18T13:39:48.450-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0938 An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka 'Microsoft Edge Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0940

2019-05-16T15:29:03.817-04:00

2019-05-20T10:01:23.307-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-05-18T11:00:02.647-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0940 A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0941

2019-06-12T10:29:01.667-04:00

2019-06-12T16:49:05.993-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-12T15:08:50.883-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0941 A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles requests, aka 'Microsoft IIS Server Denial of Service Vulnerability'.

CVE-2019-0942

2019-05-16T15:29:03.880-04:00

2019-05-20T10:28:30.477-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T13:37:05.507-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0942 An elevation of privilege vulnerability exists in the Unified Write Filter (UWF) feature for Windows 10 when it improperly restricts access to the registry, aka 'Unified Write Filter Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0943

2019-06-12T10:29:01.713-04:00

2019-06-13T15:50:56.000-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T12:05:45.467-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0943 An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system, aka 'Windows ALPC Elevation of Privilege Vulnerability'.

CVE-2019-0945

2019-05-16T15:29:03.943-04:00

2019-05-17T14:16:26.747-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T14:10:50.740-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0945 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0946, CVE-2019-0947.

CVE-2019-0946

2019-05-16T15:29:04.020-04:00

2019-05-17T14:16:25.263-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T14:04:14.513-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0946 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0947.

cpe:/a:microsoft:office:2010:sp2

CVE-2019-0947

2019-05-16T15:29:04.083-04:00

2019-05-17T14:13:41.997-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-17T13:47:30.620-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0947 A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0946.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0948

2019-06-12T10:29:01.743-04:00

2019-07-10T08:15:10.937-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0948 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-641/ An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity, aka 'Windows Event Viewer Information Disclosure Vulnerability'.

cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2016

CVE-2019-0949

2019-05-16T15:29:04.147-04:00

2019-05-20T10:28:40.820-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T15:26:59.930-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0949 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0950, CVE-2019-0951.

cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2016

CVE-2019-0950

2019-05-16T15:29:04.207-04:00

2019-05-20T11:07:52.670-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T15:26:10.507-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0950 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0951.

cpe:/a:microsoft:sharepoint_foundation:2010:sp2 cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0951

2019-05-16T15:29:04.257-04:00

2019-05-17T15:49:31.770-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T15:25:21.910-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0951 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019-0950.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0952

2019-05-16T15:29:04.317-04:00

2019-06-10T10:04:23.697-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-06-10T10:00:16.263-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0952 A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.

cpe:/a:microsoft:office:2016::~~~mac_os_x~~ cpe:/a:microsoft:office:2019::~~~mac_os_x~~ cpe:/a:microsoft:office:2019::~~click-to-run~~x64~ cpe:/a:microsoft:office:2019::~~click-to-run~~x86~ cpe:/a:microsoft:office_365_proplus:- cpe:/a:microsoft:office_online_server:- cpe:/a:microsoft:word:2016

CVE-2019-0953

2019-05-16T15:29:04.380-04:00

2019-05-16T18:00:15.337-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-16T16:45:45.330-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0953 A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0956

2019-05-16T15:29:04.443-04:00

2019-05-17T11:29:31.677-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T11:11:03.920-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0956 An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Server Information Disclosure Vulnerability'.

cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0957

2019-05-16T15:29:04.520-04:00

2019-05-17T11:02:55.910-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-05-17T10:54:48.257-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0957 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0958.

cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2019

CVE-2019-0958

2019-05-16T15:29:04.583-04:00

2019-05-17T10:57:58.340-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-05-17T10:43:55.787-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0958 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0957.

cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0959

2019-06-12T10:29:01.773-04:00

2019-06-13T14:21:16.557-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T11:55:25.407-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0959 An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0984.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0960

2019-06-12T10:29:01.807-04:00

2019-06-13T12:07:54.627-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T10:07:20.547-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0960 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1014, CVE-2019-1017.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0961

2019-05-16T15:29:04.647-04:00

2019-06-13T10:54:00.497-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T10:49:08.447-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0961 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0758, CVE-2019-0882.

cpe:/a:microsoft:azure_automation:-

CVE-2019-0962

2019-07-15T15:15:15.873-04:00

2019-07-19T11:59:04.510-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-16T13:48:49.390-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0962 An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2019-0963

2019-05-16T15:29:04.723-04:00

2019-05-17T10:36:01.213-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-17T10:19:47.327-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0963 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0965

2019-08-14T17:15:13.187-04:00

2019-08-19T13:36:41.147-04:00

7.7

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-08-19T12:23:58.623-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0965 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:1607::~~~~x64~ cpe:/o:microsoft:windows_10:1703::~~~~x64~ cpe:/o:microsoft:windows_10:1709::~~~~x64~ cpe:/o:microsoft:windows_10:1803::~~~~x64~ cpe:/o:microsoft:windows_10:1809::~~~~x64~ cpe:/o:microsoft:windows_10:1903::~~~~x64~ cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0966

2019-07-15T15:15:15.950-04:00

2019-07-18T10:49:13.377-04:00

5.5

ADJACENT_NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-07-17T12:46:00.427-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0966 A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0968

2019-06-12T10:29:01.853-04:00

2019-06-13T08:21:47.940-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T07:53:23.397-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0968 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0977, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.

cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0971

2019-05-16T15:29:04.770-04:00

2019-07-16T10:42:23.800-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-05-18T10:30:17.317-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0971 An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0972

2019-06-12T10:29:01.900-04:00

2019-06-13T11:35:05.647-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T15:24:10.847-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0972 This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a specially crafted authentication request, aka 'Local Security Authority Subsystem Service Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0973

2019-06-12T10:29:01.947-04:00

2019-06-13T13:58:54.333-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T11:49:46.487-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0973 An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer Elevation of Privilege Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0974

2019-06-12T10:29:01.993-04:00

2019-06-12T14:26:24.283-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-06-12T13:35:02.720-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0974 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904, CVE-2019-0905, CVE-2019-0906, CVE-2019-0907, CVE-2019-0908, CVE-2019-0909.

cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0975

2019-07-15T15:15:16.013-04:00

2019-07-22T13:32:14.967-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-17T12:41:32.797-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0975 A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP addresses. This security update corrects how ADFS updates its list of banned IP addresses., aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-1126.

cpe:/a:microsoft:nuget:5.0.2

CVE-2019-0976

2019-05-16T15:29:04.850-04:00

2019-05-20T17:29:00.660-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 108210 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976 A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0977

2019-06-12T10:29:02.023-04:00

2019-06-13T08:24:23.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T07:52:25.587-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0977 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-1009, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.

cpe:/a:microsoft:team_foundation_server:2017:3.1 cpe:/a:microsoft:team_foundation_server:2018:1.2 cpe:/a:microsoft:team_foundation_server:2018:3.2 cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0979

2019-05-16T15:29:04.910-04:00

2019-07-16T10:42:23.800-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T10:20:07.693-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0979 A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0872.

CVE-2019-0980

2019-05-16T15:29:04.957-04:00

2019-05-22T09:29:00.913-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2019:1259 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0980 A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.

CVE-2019-0981

2019-05-16T15:29:05.020-04:00

2019-05-22T09:29:01.083-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2019:1259 MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0981 A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.

cpe:/a:microsoft:asp.net_core:2.1 cpe:/a:microsoft:asp.net_core:2.2

CVE-2019-0982

2019-05-16T15:29:05.083-04:00

2019-05-20T08:38:21.333-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-18T09:57:19.247-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0982 A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0983

2019-06-12T10:29:02.070-04:00

2019-06-13T14:33:43.297-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T11:45:43.550-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0983 An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0998.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0984

2019-06-12T10:29:02.103-04:00

2019-06-13T12:24:07.133-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T10:46:38.363-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0984 An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0959.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-0985

2019-06-12T10:29:02.133-04:00

2019-06-13T10:42:31.830-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-06-13T09:32:38.633-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0985 A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input, aka 'Microsoft Speech API Remote Code Execution Vulnerability'.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0986

2019-06-12T10:29:02.180-04:00

2019-06-13T15:06:57.007-04:00

3.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-13T11:17:11.477-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0986 An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0988

2019-06-12T10:29:02.227-04:00

2019-08-16T06:15:10.157-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0988 MISC https://www.zerodayinitiative.com/advisories/ZDI-19-723/ A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-1005, CVE-2019-1055, CVE-2019-1080.

CVE-2019-0989

2019-06-12T10:29:02.260-04:00

2019-06-13T08:46:59.807-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:28:50.087-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0989 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

CVE-2019-0990

2019-06-12T10:29:02.307-04:00

2019-06-13T11:02:49.957-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T09:28:24.167-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0990 An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1023.

CVE-2019-0991

2019-06-12T10:29:02.337-04:00

2019-06-13T08:52:34.250-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:26:26.930-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0991 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

cpe:/a:microsoft:edge:-

CVE-2019-0992

2019-06-12T10:29:02.367-04:00

2019-06-13T08:54:21.440-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:21:58.050-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0992 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

CVE-2019-0993

2019-06-12T10:29:02.400-04:00

2019-06-13T09:08:56.140-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:20:11.860-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0993 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-0995

2019-05-16T15:29:05.130-04:00

2019-05-20T11:35:14.713-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-18T09:56:31.397-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0995 A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer Security Feature Bypass Vulnerability'.

cpe:/o:microsoft:azure_devops_server:2019

CVE-2019-0996

2019-06-12T10:29:02.417-04:00

2019-07-16T10:42:23.800-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T12:29:18.687-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996 A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery, aka 'Azure DevOps Server Spoofing Vulnerability'.

cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-0998

2019-06-12T10:29:02.447-04:00

2019-06-13T15:50:01.437-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T11:10:38.167-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0998 An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0983.

CVE-2019-0999

2019-07-15T15:15:16.123-04:00

2019-07-16T15:21:33.787-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-16T14:09:38.317-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0999 An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.

cpe:/a:microsoft:azure_active_directory_connect:-

CVE-2019-1000

2019-05-16T15:29:05.193-04:00

2019-10-10T08:10:23.480-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1000 An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell cmdlets in context of a privileged account, and perform privileged actions.To exploit this, an attacker would need to authenticate to the AzureÂ? AD Connect server, aka 'Microsoft Azure AD Connect Elevation of Privilege Vulnerability'.

cpe:/a:teampass:teampass:2.1.27.0

CVE-2019-1000001

2019-02-04T16:29:00.643-05:00

2019-02-22T08:18:01.593-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-05T11:33:18.533-05:00

MISC https://github.com/nilsteampassnet/TeamPass/issues/2495 TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.

cpe:/a:gitea:gitea:1.6.2

CVE-2019-1000002

2019-02-04T16:29:00.690-05:00

2019-02-15T11:01:48.650-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-05T12:00:09.633-05:00

MISC https://github.com/go-gitea/gitea/pull/5631 Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.

cpe:/a:mapsvg:mapsvg_lite:3.2.3

CVE-2019-1000003

2019-02-04T16:29:00.723-05:00

2019-02-15T14:40:37.420-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T10:33:31.433-05:00

MISC https://advisories.dxw.com/advisories/csrf-mapsvg-lite/ MISC https://wpvulndb.com/vulnerabilities/9198 MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.

cpe:/a:jspmyadmin:jspmyadmin2:1.0.6

CVE-2019-1000004

2019-02-04T16:29:00.767-05:00

2019-02-06T10:34:39.390-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-06T10:26:06.127-05:00

MISC https://github.com/yugandhargangu/JspMyAdmin2/issues/22 yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question.

cpe:/a:mpdf_project:mpdf:7.1.7

CVE-2019-1000005

2019-02-04T16:29:00.800-05:00

2019-02-14T15:06:31.353-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-05T16:01:11.277-05:00

MISC https://github.com/mpdf/mpdf/issues/949 mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.

cpe:/o:riot-os:riot-os:2017.04-rc1

CVE-2019-1000006

2019-02-04T16:29:00.830-05:00

2019-02-15T10:44:09.707-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T10:22:47.140-05:00

MISC https://github.com/RIOT-OS/RIOT/issues/10739 RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.

cpe:/a:aioxmpp_project:aioxmpp:0.10.2

CVE-2019-1000007

2019-02-04T16:29:00.877-05:00

2019-02-15T10:00:51.450-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-05T15:33:17.717-05:00

MISC https://github.com/horazont/aioxmpp/pull/268 aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.

cpe:/a:helm:helm:2.0.0:- cpe:/a:helm:helm:2.0.0:alpha.1 cpe:/a:helm:helm:2.0.0:alpha.2 cpe:/a:helm:helm:2.0.0:alpha.3 cpe:/a:helm:helm:2.0.0:alpha.4 cpe:/a:helm:helm:2.0.0:alpha.5 cpe:/a:helm:helm:2.0.0:beta.1 cpe:/a:helm:helm:2.0.0:beta.2 cpe:/a:helm:helm:2.0.0:rc.1 cpe:/a:helm:helm:2.0.0:rc.2 cpe:/a:helm:helm:2.0.1 cpe:/a:helm:helm:2.0.2 cpe:/a:helm:helm:2.1.0 cpe:/a:helm:helm:2.1.1 cpe:/a:helm:helm:2.1.2 cpe:/a:helm:helm:2.1.3 cpe:/a:helm:helm:2.2.0 cpe:/a:helm:helm:2.2.1 cpe:/a:helm:helm:2.2.2 cpe:/a:helm:helm:2.2.3 cpe:/a:helm:helm:2.3.0 cpe:/a:helm:helm:2.3.1 cpe:/a:helm:helm:2.4.0 cpe:/a:helm:helm:2.4.1 cpe:/a:helm:helm:2.4.2 cpe:/a:helm:helm:2.5.0 cpe:/a:helm:helm:2.5.1 cpe:/a:helm:helm:2.6.0 cpe:/a:helm:helm:2.6.1 cpe:/a:helm:helm:2.6.2 cpe:/a:helm:helm:2.7.0:- cpe:/a:helm:helm:2.7.0:rc1 cpe:/a:helm:helm:2.7.1 cpe:/a:helm:helm:2.7.2 cpe:/a:helm:helm:2.8.0:rc.1 cpe:/a:helm:helm:2.8.1 cpe:/a:helm:helm:2.8.2:- cpe:/a:helm:helm:2.8.2:rc1 cpe:/a:helm:helm:2.9.0:- cpe:/a:helm:helm:2.9.0:rc1 cpe:/a:helm:helm:2.9.0:rc2 cpe:/a:helm:helm:2.9.0:rc3 cpe:/a:helm:helm:2.9.0:rc4 cpe:/a:helm:helm:2.9.0:rc5 cpe:/a:helm:helm:2.9.1 cpe:/a:helm:helm:2.10.0:- cpe:/a:helm:helm:2.10.0:rc.1 cpe:/a:helm:helm:2.10.0:rc.2 cpe:/a:helm:helm:2.10.0:rc.3 cpe:/a:helm:helm:2.11.0:- cpe:/a:helm:helm:2.11.0:rc.1 cpe:/a:helm:helm:2.11.0:rc.2 cpe:/a:helm:helm:2.11.0:rc.3 cpe:/a:helm:helm:2.11.0:rc.4 cpe:/a:helm:helm:2.12.0:- cpe:/a:helm:helm:2.12.0:rc.1 cpe:/a:helm:helm:2.12.0:rc.2 cpe:/a:helm:helm:2.12.1

CVE-2019-1000008

2019-02-04T16:29:00.910-05:00

2019-02-15T10:20:10.520-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-05T15:15:35.647-05:00

MISC https://helm.sh/blog/helm-security-notice-2019/index.html All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.

cpe:/a:helm:chartmuseum:0.1.0 cpe:/a:helm:chartmuseum:0.1.1 cpe:/a:helm:chartmuseum:0.1.2 cpe:/a:helm:chartmuseum:0.2.0 cpe:/a:helm:chartmuseum:0.2.1 cpe:/a:helm:chartmuseum:0.2.2 cpe:/a:helm:chartmuseum:0.2.3 cpe:/a:helm:chartmuseum:0.2.4 cpe:/a:helm:chartmuseum:0.2.5 cpe:/a:helm:chartmuseum:0.2.6 cpe:/a:helm:chartmuseum:0.2.7 cpe:/a:helm:chartmuseum:0.2.8 cpe:/a:helm:chartmuseum:0.3.0 cpe:/a:helm:chartmuseum:0.3.1 cpe:/a:helm:chartmuseum:0.4.0 cpe:/a:helm:chartmuseum:0.4.1 cpe:/a:helm:chartmuseum:0.4.2 cpe:/a:helm:chartmuseum:0.5.0 cpe:/a:helm:chartmuseum:0.5.1 cpe:/a:helm:chartmuseum:0.5.2 cpe:/a:helm:chartmuseum:0.6.0 cpe:/a:helm:chartmuseum:0.7.0 cpe:/a:helm:chartmuseum:0.7.1 cpe:/a:helm:chartmuseum:0.8.0

CVE-2019-1000009

2019-02-04T16:29:00.957-05:00

2019-02-08T14:06:58.143-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-06T07:16:01.920-05:00

MISC https://helm.sh/blog/chartmuseum-security-notice-2019/index.html Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1.

cpe:/a:phpipam:phpipam:1.3.2

CVE-2019-1000010

2019-02-04T16:29:01.003-05:00

2019-02-06T07:50:52.387-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-05T14:42:53.277-05:00

MISC https://github.com/phpipam/phpipam/commit/fd37bd8fb2b9c306079db505e0e3fe79a096c31c MISC https://github.com/phpipam/phpipam/issues/2327 phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.

cpe:/a:api-platform:core:2.2.0 cpe:/a:api-platform:core:2.2.1 cpe:/a:api-platform:core:2.2.2 cpe:/a:api-platform:core:2.2.3 cpe:/a:api-platform:core:2.2.4 cpe:/a:api-platform:core:2.2.5 cpe:/a:api-platform:core:2.2.6 cpe:/a:api-platform:core:2.2.7 cpe:/a:api-platform:core:2.2.8 cpe:/a:api-platform:core:2.2.9 cpe:/a:api-platform:core:2.3.0 cpe:/a:api-platform:core:2.3.1 cpe:/a:api-platform:core:2.3.2 cpe:/a:api-platform:core:2.3.3 cpe:/a:api-platform:core:2.3.4 cpe:/a:api-platform:core:2.3.5

CVE-2019-1000011

2019-02-04T16:29:01.050-05:00

2019-02-15T15:31:04.913-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T07:58:05.973-05:00

MISC https://github.com/api-platform/core/issues/2364 MISC https://github.com/api-platform/core/pull/2441 API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

cpe:/a:hex:hex:0.14.0 cpe:/a:hex:hex:0.14.1 cpe:/a:hex:hex:0.15.0 cpe:/a:hex:hex:0.16.0 cpe:/a:hex:hex:0.16.1 cpe:/a:hex:hex:0.17.0 cpe:/a:hex:hex:0.17.1 cpe:/a:hex:hex:0.17.2 cpe:/a:hex:hex:0.17.3 cpe:/a:hex:hex:0.17.4 cpe:/a:hex:hex:0.17.5 cpe:/a:hex:hex:0.17.6 cpe:/a:hex:hex:0.17.7 cpe:/a:hex:hex:0.17.8 cpe:/a:hex:hex:0.18.0 cpe:/a:hex:hex:0.18.1 cpe:/a:hex:hex:0.18.2

CVE-2019-1000012

2019-02-04T16:29:01.097-05:00

2019-04-01T13:19:13.670-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-01T13:07:31.843-04:00

MISC https://github.com/hexpm/hex/pull/646 MISC https://github.com/hexpm/hex/pull/651 Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

cpe:/a:hex:hex_core:0.3.0

CVE-2019-1000013

2019-02-04T16:29:01.143-05:00

2019-02-15T09:37:45.003-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T09:06:54.410-05:00

MISC https://github.com/hexpm/hex_core/pull/48 MISC https://github.com/hexpm/hex_core/pull/51 Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.

cpe:/a:erlang:rebar3:3.7.0 cpe:/a:erlang:rebar3:3.7.1 cpe:/a:erlang:rebar3:3.7.2 cpe:/a:erlang:rebar3:3.7.3 cpe:/a:erlang:rebar3:3.7.4 cpe:/a:erlang:rebar3:3.7.5

CVE-2019-1000014

2019-02-04T16:29:01.207-05:00

2019-02-20T15:18:59.477-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T09:17:03.320-05:00

MISC https://github.com/erlang/rebar3/pull/1986 Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.

cpe:/a:chamilo:chamilo_lms:1.11.8

CVE-2019-1000015

2019-02-04T16:29:01.237-05:00

2019-02-20T13:10:48.387-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-05T14:58:57.390-05:00

MISC https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03 Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.

cpe:/a:ffmpeg:ffmpeg:4.1

CVE-2019-1000016

2019-02-04T16:29:01.283-05:00

2019-02-06T12:00:29.340-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T09:47:20.687-05:00

MISC https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.

cpe:/a:chamilo:chamilo_lms:1.11.8

CVE-2019-1000017

2019-02-04T16:29:01.330-05:00

2019-02-07T15:32:04.797-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-06T07:14:54.450-05:00

MISC https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03 MISC https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-34-2019-01-14-Moderate-risk-moderate-impact-XSS-and-unauthorized-access Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.

cpe:/a:pizzashack:rssh:2.3.4 cpe:/o:debian:debian_linux:8.0 cpe:/o:debian:debian_linux:9.0

CVE-2019-1000018

2019-02-04T16:29:01.377-05:00

2019-04-11T18:29:00.617-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://esnet-security.github.io/vulnerabilities/20190115_rssh MLIST [debian-lts-announce] 20190130 [SECURITY] [DLA 1650-1] rssh security update UBUNTU USN-3946-1 DEBIAN DSA-4377 rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

cpe:/a:libarchive:libarchive:3.0.2 cpe:/a:libarchive:libarchive:3.0.3 cpe:/a:libarchive:libarchive:3.0.4 cpe:/a:libarchive:libarchive:3.1.0 cpe:/a:libarchive:libarchive:3.1.1 cpe:/a:libarchive:libarchive:3.1.2::~~~x64~~ cpe:/a:libarchive:libarchive:3.1.2:- cpe:/a:libarchive:libarchive:3.1.900a cpe:/a:libarchive:libarchive:3.1.901a cpe:/a:libarchive:libarchive:3.2.0 cpe:/a:libarchive:libarchive:3.2.1 cpe:/a:libarchive:libarchive:3.2.2 cpe:/a:libarchive:libarchive:3.3.0 cpe:/a:libarchive:libarchive:3.3.1 cpe:/a:libarchive:libarchive:3.3.2 cpe:/a:libarchive:libarchive:3.3.3 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:fedoraproject:fedora:29

CVE-2019-1000019

2019-02-04T16:29:01.410-05:00

2019-04-12T09:29:01.750-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1196 REDHAT RHSA-2019:2298 MISC https://github.com/libarchive/libarchive/pull/1120 MISC https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1 MLIST [debian-lts-announce] 20190207 [SECURITY] [DLA 1668-1] libarchive security update FEDORA FEDORA-2019-c595a93536 FEDORA FEDORA-2019-0233ec0ff3 UBUNTU USN-3884-1 libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.

cpe:/a:libarchive:libarchive:2.8.0 cpe:/a:libarchive:libarchive:2.8.1 cpe:/a:libarchive:libarchive:2.8.2 cpe:/a:libarchive:libarchive:2.8.3 cpe:/a:libarchive:libarchive:2.8.4 cpe:/a:libarchive:libarchive:2.8.5 cpe:/a:libarchive:libarchive:3.0.0a cpe:/a:libarchive:libarchive:3.0.1b cpe:/a:libarchive:libarchive:3.0.2 cpe:/a:libarchive:libarchive:3.0.3 cpe:/a:libarchive:libarchive:3.0.4 cpe:/a:libarchive:libarchive:3.1.0 cpe:/a:libarchive:libarchive:3.1.1 cpe:/a:libarchive:libarchive:3.1.2::~~~x64~~ cpe:/a:libarchive:libarchive:3.1.2:- cpe:/a:libarchive:libarchive:3.1.900a cpe:/a:libarchive:libarchive:3.1.901a cpe:/a:libarchive:libarchive:3.2.0 cpe:/a:libarchive:libarchive:3.2.1 cpe:/a:libarchive:libarchive:3.2.2 cpe:/a:libarchive:libarchive:3.3.0 cpe:/a:libarchive:libarchive:3.3.1 cpe:/a:libarchive:libarchive:3.3.2 cpe:/a:libarchive:libarchive:3.3.3 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:fedoraproject:fedora:29

CVE-2019-1000020

2019-02-04T16:29:01.457-05:00

2019-04-12T09:29:01.987-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1196 REDHAT RHSA-2019:2298 MISC https://github.com/libarchive/libarchive/pull/1120 MISC https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423 MLIST [debian-lts-announce] 20190207 [SECURITY] [DLA 1668-1] libarchive security update FEDORA FEDORA-2019-c595a93536 FEDORA FEDORA-2019-0233ec0ff3 UBUNTU USN-3884-1 libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.

cpe:/a:slixmpp_project:slixmpp:1.2.4 cpe:/a:slixmpp_project:slixmpp:1.3.0 cpe:/a:slixmpp_project:slixmpp:1.4.0 cpe:/a:slixmpp_project:slixmpp:1.4.1

CVE-2019-1000021

2019-02-04T16:29:01.517-05:00

2019-09-02T23:15:10.167-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416 FEDORA FEDORA-2019-f40c49b99e FEDORA FEDORA-2019-5a947d8603 MISC https://xmpp.org/extensions/xep-0223.html#howitworks slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.

cpe:/a:taoensso:sente:0.8.0 cpe:/a:taoensso:sente:0.8.1 cpe:/a:taoensso:sente:0.8.2 cpe:/a:taoensso:sente:0.9.0 cpe:/a:taoensso:sente:0.10.0 cpe:/a:taoensso:sente:0.10.1 cpe:/a:taoensso:sente:0.11.0 cpe:/a:taoensso:sente:0.12.0 cpe:/a:taoensso:sente:0.13.0 cpe:/a:taoensso:sente:0.14.0 cpe:/a:taoensso:sente:0.14.1 cpe:/a:taoensso:sente:0.15.0 cpe:/a:taoensso:sente:0.15.1 cpe:/a:taoensso:sente:1.0.0 cpe:/a:taoensso:sente:1.1.0 cpe:/a:taoensso:sente:1.2.0 cpe:/a:taoensso:sente:1.3.0 cpe:/a:taoensso:sente:1.4.0 cpe:/a:taoensso:sente:1.4.1 cpe:/a:taoensso:sente:1.5.0 cpe:/a:taoensso:sente:1.6.0 cpe:/a:taoensso:sente:1.7.0:- cpe:/a:taoensso:sente:1.7.0:rc1 cpe:/a:taoensso:sente:1.8.0:- cpe:/a:taoensso:sente:1.8.0:beta1 cpe:/a:taoensso:sente:1.8.1 cpe:/a:taoensso:sente:1.9.0:- cpe:/a:taoensso:sente:1.9.0:beta1 cpe:/a:taoensso:sente:1.9.0:beta2 cpe:/a:taoensso:sente:1.9.0:beta3 cpe:/a:taoensso:sente:1.9.0:rc1 cpe:/a:taoensso:sente:1.9.0:rc2 cpe:/a:taoensso:sente:1.10.0 cpe:/a:taoensso:sente:1.11.0:- cpe:/a:taoensso:sente:1.11.0:rc1 cpe:/a:taoensso:sente:1.12.0 cpe:/a:taoensso:sente:1.12.1 cpe:/a:taoensso:sente:1.13.0 cpe:/a:taoensso:sente:1.13.1

CVE-2019-1000022

2019-02-04T16:29:01.567-05:00

2019-02-20T12:51:35.903-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T10:33:17.763-05:00

MISC https://github.com/ptaoussanis/sente/issues/137 Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitable via malicious request against WebSocket handshake endpoint. This vulnerability appears to have been fixed in 1.14.0 and later.

cpe:/a:opt-net:ng-netms:3.6-2

CVE-2019-1000023

2019-02-04T16:29:01.613-05:00

2019-02-06T12:53:37.080-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-06T10:48:27.187-05:00

MISC https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html MISC https://sourceforge.net/projects/ngnms/ MISC https://www.owasp.org/index.php/SQL_Injection OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, id_access_type and id_attr_access that can result in a malicious attacker can include own SQL commands which database will execute. This attack appears to be exploitable via network connectivity.

cpe:/a:opt-net:ng-netms:3.6-2

CVE-2019-1000024

2019-02-04T16:29:01.677-05:00

2019-02-06T12:46:29.040-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-06T11:00:28.587-05:00

MISC https://inf0seq.github.io/cve/2019/01/20/Cross-site-scripting-(XSS)-in-OPTOSS-Next-Gen-Network-Management-System-(NG-NetMS).html MISC https://sourceforge.net/projects/ngnms/ MISC https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result in Cross-site scripting.This attack appear to be exploitable via network connectivity.

CVE-2019-1000030

2019-02-20T22:15:08.607-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-7580. Reason: This candidate is a reservation duplicate of CVE-2019-7580. Notes: All CVE users should reference CVE-2019-7580 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:article2pdf_project:article2pdf:0.24::~~~wordpress~~ cpe:/a:article2pdf_project:article2pdf:0.25::~~~wordpress~~ cpe:/a:article2pdf_project:article2pdf:0.26::~~~wordpress~~ cpe:/a:article2pdf_project:article2pdf:0.27::~~~wordpress~~

CVE-2019-1000031

2019-03-27T14:29:00.567-04:00

2019-08-03T17:15:11.007-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html BUGTRAQ 20190326 [article2pdf (Wordpress plug-in)] Multiple vulnerabilities (CVE-2019-1000031, CVE-2019-1010257) MISC https://wpvulndb.com/vulnerabilities/9246 A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.

CVE-2019-1000033

2019-07-26T17:15:11.327-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010259. Reason: This candidate is a reservation duplicate of CVE-2019-1010259. Notes: All CVE users should reference CVE-2019-1010259 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1000041

2019-02-20T22:15:08.620-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-7575, CVE-2019-7577. Reason: This candidate is a reservation duplicate of CVE-2019-7575 and/or CVE-2019-7577. Notes: All CVE users should reference CVE-2019-7575 and/or CVE-2019-7577 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1000047

2019-02-20T22:15:08.637-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-7469. Reason: This candidate is a reservation duplicate of CVE-2013-7469. Notes: All CVE users should reference CVE-2013-7469 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1000048

2019-02-20T22:15:08.653-05:00

CVE-2019-1000049

2019-02-20T22:15:08.667-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-8363. Reason: This candidate is a reservation duplicate of CVE-2019-8363. Notes: All CVE users should reference CVE-2019-8363 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:zohocorp:servicedesk_plus:9.3

CVE-2019-10008

2019-04-24T15:29:00.907-04:00

2019-04-25T12:33:23.347-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-04-24T23:11:15.367-04:00

EXPLOIT-DB 46659 CONFIRM https://www.manageengine.com/products/service-desk/readme.html Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.

cpe:/a:southrivertech:titan_ftp_server:2019:3505

CVE-2019-10009

2019-06-03T17:29:00.350-04:00

2019-06-06T16:29:02.307-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152244/Titan-FTP-Server-2019-Build-3505-Directory-Traversal.html FULLDISC 20190326 CVE-2019-10009 Titan FTP Server Version 2019 Build 3505 Directory Traversal/Local File Inclusion CONFIRM http://www.southrivertech.com/software/regsoft/titanftp/v19/verhist_en.html MISC https://seclists.org/fulldisclosure/2019/Mar/47 EXPLOIT-DB 46611 EXPLOIT-DB 46611 A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.

CVE-2019-1001

2019-07-15T15:15:16.217-04:00

2019-07-16T21:09:19.170-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-07-16T09:11:06.133-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1001 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1004, CVE-2019-1056, CVE-2019-1059.

cpe:/a:thephpleague:commonmark:0.5.0 cpe:/a:thephpleague:commonmark:0.5.1 cpe:/a:thephpleague:commonmark:0.6.0 cpe:/a:thephpleague:commonmark:0.6.1 cpe:/a:thephpleague:commonmark:0.7.0 cpe:/a:thephpleague:commonmark:0.7.1 cpe:/a:thephpleague:commonmark:0.7.2 cpe:/a:thephpleague:commonmark:0.8.0 cpe:/a:thephpleague:commonmark:0.9.0 cpe:/a:thephpleague:commonmark:0.10.0 cpe:/a:thephpleague:commonmark:0.11.0 cpe:/a:thephpleague:commonmark:0.11.1 cpe:/a:thephpleague:commonmark:0.11.2 cpe:/a:thephpleague:commonmark:0.11.3 cpe:/a:thephpleague:commonmark:0.12.0 cpe:/a:thephpleague:commonmark:0.13.0 cpe:/a:thephpleague:commonmark:0.13.1 cpe:/a:thephpleague:commonmark:0.13.2 cpe:/a:thephpleague:commonmark:0.13.3 cpe:/a:thephpleague:commonmark:0.13.4 cpe:/a:thephpleague:commonmark:0.14.0 cpe:/a:thephpleague:commonmark:0.15.0 cpe:/a:thephpleague:commonmark:0.15.1 cpe:/a:thephpleague:commonmark:0.15.2 cpe:/a:thephpleague:commonmark:0.15.3 cpe:/a:thephpleague:commonmark:0.15.4 cpe:/a:thephpleague:commonmark:0.15.5 cpe:/a:thephpleague:commonmark:0.15.6 cpe:/a:thephpleague:commonmark:0.15.7 cpe:/a:thephpleague:commonmark:0.16.0 cpe:/a:thephpleague:commonmark:0.17.0 cpe:/a:thephpleague:commonmark:0.17.1 cpe:/a:thephpleague:commonmark:0.17.2 cpe:/a:thephpleague:commonmark:0.17.3 cpe:/a:thephpleague:commonmark:0.17.4 cpe:/a:thephpleague:commonmark:0.17.5 cpe:/a:thephpleague:commonmark:0.18.0 cpe:/a:thephpleague:commonmark:0.18.1 cpe:/a:thephpleague:commonmark:0.18.2

CVE-2019-10010

2019-03-24T14:29:00.270-04:00

2019-03-26T15:03:08.470-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T12:59:09.397-04:00

MISC https://github.com/thephpleague/commonmark/issues/353 MISC https://github.com/thephpleague/commonmark/releases/tag/0.18.3 Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.

CVE-2019-10011

2019-03-25T15:29:01.367-04:00

2019-04-08T08:11:48.903-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-03-26T13:54:19.333-04:00

MISC https://medium.com/@mdavis332/higher-ed-erp-portal-vulnerability-create-your-own-accounts-d865bd22cdd8 ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.

cpe:/a:jenzabar:internet_campus_solution:9 cpe:/a:tiny:moxiemanager:1.0::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.4::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.5::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.6::~~~.net~~ cpe:/a:tiny:moxiemanager:1.0.7::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.4::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.5::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.6::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.7::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.8::~~~.net~~ cpe:/a:tiny:moxiemanager:1.1.9::~~~.net~~ cpe:/a:tiny:moxiemanager:1.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.2.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.2.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.2.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.3.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.3.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.3.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.3.4::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.0::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.1::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.2::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.3::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.4::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.5::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.6::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.7::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.8::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.9::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.10::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.11::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.12::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.13::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.14::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.15::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.16::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.17::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.18::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.19::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.20::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.21::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.22::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.23::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.24::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.25::~~~.net~~ cpe:/a:tiny:moxiemanager:1.4.26::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.0::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.1::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.2::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.3::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.4::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.5::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.6::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.7::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.8::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.9::~~~.net~~ cpe:/a:tiny:moxiemanager:2.0.10::~~~.net~~ cpe:/a:tiny:moxiemanager:2.1.0::~~~.net~~ cpe:/a:tiny:moxiemanager:2.1.1::~~~.net~~ cpe:/a:tiny:moxiemanager:2.1.2::~~~.net~~ cpe:/a:tiny:moxiemanager:2.1.3::~~~.net~~

CVE-2019-10012

2019-03-25T15:29:01.413-04:00

2019-09-20T15:00:28.053-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-09-20T12:24:51.617-04:00

MISC https://medium.com/@mdavis332/critical-vulnerability-in-higher-ed-erp-55580f8880c MISC https://www.sjoerdlangkemper.nl/2016/09/15/uploading-webshells-with-moxiemanager/ Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer.

cpe:/a:dedecms:dedecms:5.7:sp2

CVE-2019-10014

2019-03-24T18:29:00.237-04:00

2019-03-26T09:41:04.903-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-25T14:41:21.663-04:00

MISC https://blog.csdn.net/yalecaltech/article/details/88594388 In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.

cpe:/a:baigo:baigo_sso:3.0.1

CVE-2019-10015

2019-03-24T18:29:00.297-04:00

2019-03-25T14:40:13.780-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-03-25T13:31:31.813-04:00

MISC https://github.com/baigoStudio/baigoSSO/issues/12 baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.

cpe:/a:gforge:advanced_server:6.4.4

CVE-2019-10016

2019-03-24T23:29:00.193-04:00

2019-03-26T12:55:15.500-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T12:38:57.420-04:00

MISC https://ctrsec.io/index.php/2019/03/24/gforge-advanced-server-xss-commonsearch-php/ GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.

cpe:/a:cmsmadesimple:cms_made_simple:2.2.10

CVE-2019-10017

2019-03-24T18:29:00.347-04:00

2019-07-18T12:27:06.033-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-18T09:26:50.253-04:00

MISC http://dev.cmsmadesimple.org/bug/view/12001 MISC https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/ CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10018

2019-03-24T20:29:05.543-04:00

2019-06-27T12:15:11.430-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276 UBUNTU USN-4042-1 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10019

2019-03-24T20:29:05.573-04:00

2019-06-27T12:15:11.633-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41275 UBUNTU USN-4042-1 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes.

cpe:/a:microsoft:edge:-

CVE-2019-1002

2019-06-12T10:29:02.493-04:00

2019-06-13T09:18:24.320-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:14:59.950-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1002 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10020

2019-03-24T20:29:05.620-04:00

2019-03-25T16:27:42.783-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-25T14:58:15.010-04:00

MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10021

2019-03-24T20:29:05.650-04:00

2019-06-27T12:15:11.743-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274 UBUNTU USN-4042-1 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps.

cpe:/a:kubernetes:kubernetes:0.2 cpe:/a:kubernetes:kubernetes:0.3 cpe:/a:kubernetes:kubernetes:0.4 cpe:/a:kubernetes:kubernetes:0.4.1 cpe:/a:kubernetes:kubernetes:0.4.2 cpe:/a:kubernetes:kubernetes:0.4.3 cpe:/a:kubernetes:kubernetes:0.4.4 cpe:/a:kubernetes:kubernetes:0.5 cpe:/a:kubernetes:kubernetes:0.5.1 cpe:/a:kubernetes:kubernetes:0.5.2 cpe:/a:kubernetes:kubernetes:0.5.3 cpe:/a:kubernetes:kubernetes:0.5.4 cpe:/a:kubernetes:kubernetes:0.5.5 cpe:/a:kubernetes:kubernetes:0.5.6 cpe:/a:kubernetes:kubernetes:0.6.0 cpe:/a:kubernetes:kubernetes:0.6.1 cpe:/a:kubernetes:kubernetes:0.6.2 cpe:/a:kubernetes:kubernetes:0.7.0 cpe:/a:kubernetes:kubernetes:0.7.1 cpe:/a:kubernetes:kubernetes:0.7.2 cpe:/a:kubernetes:kubernetes:0.7.3 cpe:/a:kubernetes:kubernetes:0.7.4 cpe:/a:kubernetes:kubernetes:0.8.0 cpe:/a:kubernetes:kubernetes:0.8.1 cpe:/a:kubernetes:kubernetes:0.8.2 cpe:/a:kubernetes:kubernetes:0.8.4 cpe:/a:kubernetes:kubernetes:0.9.0 cpe:/a:kubernetes:kubernetes:0.9.1 cpe:/a:kubernetes:kubernetes:0.9.2 cpe:/a:kubernetes:kubernetes:0.9.3 cpe:/a:kubernetes:kubernetes:0.10.0 cpe:/a:kubernetes:kubernetes:0.10.1 cpe:/a:kubernetes:kubernetes:0.11.0 cpe:/a:kubernetes:kubernetes:0.12.0 cpe:/a:kubernetes:kubernetes:0.12.1 cpe:/a:kubernetes:kubernetes:0.12.2 cpe:/a:kubernetes:kubernetes:0.13.0 cpe:/a:kubernetes:kubernetes:0.13.1 cpe:/a:kubernetes:kubernetes:0.13.1:- cpe:/a:kubernetes:kubernetes:0.13.1:dev cpe:/a:kubernetes:kubernetes:0.13.2 cpe:/a:kubernetes:kubernetes:0.14.0 cpe:/a:kubernetes:kubernetes:0.14.1 cpe:/a:kubernetes:kubernetes:0.14.2 cpe:/a:kubernetes:kubernetes:0.15.0 cpe:/a:kubernetes:kubernetes:0.16.0 cpe:/a:kubernetes:kubernetes:0.16.1 cpe:/a:kubernetes:kubernetes:0.16.2 cpe:/a:kubernetes:kubernetes:0.17.0 cpe:/a:kubernetes:kubernetes:0.17.1 cpe:/a:kubernetes:kubernetes:0.18.0 cpe:/a:kubernetes:kubernetes:0.18.1 cpe:/a:kubernetes:kubernetes:0.18.2 cpe:/a:kubernetes:kubernetes:0.19.0 cpe:/a:kubernetes:kubernetes:0.19.1 cpe:/a:kubernetes:kubernetes:0.19.2 cpe:/a:kubernetes:kubernetes:0.19.3 cpe:/a:kubernetes:kubernetes:0.20.0 cpe:/a:kubernetes:kubernetes:0.20.1 cpe:/a:kubernetes:kubernetes:0.20.2 cpe:/a:kubernetes:kubernetes:0.21.0 cpe:/a:kubernetes:kubernetes:0.21.1 cpe:/a:kubernetes:kubernetes:0.21.2 cpe:/a:kubernetes:kubernetes:0.21.3 cpe:/a:kubernetes:kubernetes:0.21.4 cpe:/a:kubernetes:kubernetes:1.0.0 cpe:/a:kubernetes:kubernetes:1.0.1 cpe:/a:kubernetes:kubernetes:1.0.2 cpe:/a:kubernetes:kubernetes:1.0.3 cpe:/a:kubernetes:kubernetes:1.0.4 cpe:/a:kubernetes:kubernetes:1.0.5 cpe:/a:kubernetes:kubernetes:1.0.6 cpe:/a:kubernetes:kubernetes:1.0.7 cpe:/a:kubernetes:kubernetes:1.0.8:beta cpe:/a:kubernetes:kubernetes:1.1.0 cpe:/a:kubernetes:kubernetes:1.1.0:- cpe:/a:kubernetes:kubernetes:1.1.0:alpha0 cpe:/a:kubernetes:kubernetes:1.1.0:alpha1 cpe:/a:kubernetes:kubernetes:1.1.0:beta cpe:/a:kubernetes:kubernetes:1.1.1 cpe:/a:kubernetes:kubernetes:1.1.1:- cpe:/a:kubernetes:kubernetes:1.1.1:beta cpe:/a:kubernetes:kubernetes:1.1.1:beta0 cpe:/a:kubernetes:kubernetes:1.1.1:beta1 cpe:/a:kubernetes:kubernetes:1.1.2 cpe:/a:kubernetes:kubernetes:1.1.2:- cpe:/a:kubernetes:kubernetes:1.1.2:beta0 cpe:/a:kubernetes:kubernetes:1.1.3 cpe:/a:kubernetes:kubernetes:1.1.3:- cpe:/a:kubernetes:kubernetes:1.1.3:beta0 cpe:/a:kubernetes:kubernetes:1.1.4 cpe:/a:kubernetes:kubernetes:1.1.4:- cpe:/a:kubernetes:kubernetes:1.1.4:beta0 cpe:/a:kubernetes:kubernetes:1.1.5 cpe:/a:kubernetes:kubernetes:1.1.5:- cpe:/a:kubernetes:kubernetes:1.1.5:beta0 cpe:/a:kubernetes:kubernetes:1.1.6 cpe:/a:kubernetes:kubernetes:1.1.6:- cpe:/a:kubernetes:kubernetes:1.1.6:beta0 cpe:/a:kubernetes:kubernetes:1.1.7 cpe:/a:kubernetes:kubernetes:1.1.7:- cpe:/a:kubernetes:kubernetes:1.1.7:beta0 cpe:/a:kubernetes:kubernetes:1.1.8 cpe:/a:kubernetes:kubernetes:1.1.8:- cpe:/a:kubernetes:kubernetes:1.1.8:beta0 cpe:/a:kubernetes:kubernetes:1.1.9:beta0 cpe:/a:kubernetes:kubernetes:1.2.0 cpe:/a:kubernetes:kubernetes:1.2.0:- cpe:/a:kubernetes:kubernetes:1.2.0:alpha0 cpe:/a:kubernetes:kubernetes:1.2.0:alpha1 cpe:/a:kubernetes:kubernetes:1.2.0:alpha2 cpe:/a:kubernetes:kubernetes:1.2.0:alpha3 cpe:/a:kubernetes:kubernetes:1.2.0:alpha4 cpe:/a:kubernetes:kubernetes:1.2.0:alpha5 cpe:/a:kubernetes:kubernetes:1.2.0:alpha6 cpe:/a:kubernetes:kubernetes:1.2.0:alpha7 cpe:/a:kubernetes:kubernetes:1.2.0:alpha8 cpe:/a:kubernetes:kubernetes:1.2.0:beta0 cpe:/a:kubernetes:kubernetes:1.2.0:beta1 cpe:/a:kubernetes:kubernetes:1.2.1 cpe:/a:kubernetes:kubernetes:1.2.1:- cpe:/a:kubernetes:kubernetes:1.2.1:beta0 cpe:/a:kubernetes:kubernetes:1.2.2 cpe:/a:kubernetes:kubernetes:1.2.2:- cpe:/a:kubernetes:kubernetes:1.2.2:beta0 cpe:/a:kubernetes:kubernetes:1.2.3 cpe:/a:kubernetes:kubernetes:1.2.3:- cpe:/a:kubernetes:kubernetes:1.2.3:beta0 cpe:/a:kubernetes:kubernetes:1.2.4 cpe:/a:kubernetes:kubernetes:1.2.4:- cpe:/a:kubernetes:kubernetes:1.2.4:beta0 cpe:/a:kubernetes:kubernetes:1.2.5 cpe:/a:kubernetes:kubernetes:1.2.5:- cpe:/a:kubernetes:kubernetes:1.2.5:beta0 cpe:/a:kubernetes:kubernetes:1.2.6 cpe:/a:kubernetes:kubernetes:1.2.6:- cpe:/a:kubernetes:kubernetes:1.2.6:beta0 cpe:/a:kubernetes:kubernetes:1.2.7 cpe:/a:kubernetes:kubernetes:1.2.7:- cpe:/a:kubernetes:kubernetes:1.2.7:beta0 cpe:/a:kubernetes:kubernetes:1.2.8:beta0 cpe:/a:kubernetes:kubernetes:1.3.0 cpe:/a:kubernetes:kubernetes:1.3.0:- cpe:/a:kubernetes:kubernetes:1.3.0:alpha0 cpe:/a:kubernetes:kubernetes:1.3.0:alpha1 cpe:/a:kubernetes:kubernetes:1.3.0:alpha2 cpe:/a:kubernetes:kubernetes:1.3.0:alpha3 cpe:/a:kubernetes:kubernetes:1.3.0:alpha4 cpe:/a:kubernetes:kubernetes:1.3.0:alpha5 cpe:/a:kubernetes:kubernetes:1.3.0:beta0 cpe:/a:kubernetes:kubernetes:1.3.0:beta1 cpe:/a:kubernetes:kubernetes:1.3.0:beta2 cpe:/a:kubernetes:kubernetes:1.3.0:beta3 cpe:/a:kubernetes:kubernetes:1.3.1 cpe:/a:kubernetes:kubernetes:1.3.1:- cpe:/a:kubernetes:kubernetes:1.3.1:beta0 cpe:/a:kubernetes:kubernetes:1.3.1:beta1 cpe:/a:kubernetes:kubernetes:1.3.2 cpe:/a:kubernetes:kubernetes:1.3.2:- cpe:/a:kubernetes:kubernetes:1.3.2:beta0 cpe:/a:kubernetes:kubernetes:1.3.3 cpe:/a:kubernetes:kubernetes:1.3.3:- cpe:/a:kubernetes:kubernetes:1.3.3:beta0 cpe:/a:kubernetes:kubernetes:1.3.4 cpe:/a:kubernetes:kubernetes:1.3.4:- cpe:/a:kubernetes:kubernetes:1.3.4:beta0 cpe:/a:kubernetes:kubernetes:1.3.5 cpe:/a:kubernetes:kubernetes:1.3.5:- cpe:/a:kubernetes:kubernetes:1.3.5:beta0 cpe:/a:kubernetes:kubernetes:1.3.6 cpe:/a:kubernetes:kubernetes:1.3.6:- cpe:/a:kubernetes:kubernetes:1.3.6:beta0 cpe:/a:kubernetes:kubernetes:1.3.7 cpe:/a:kubernetes:kubernetes:1.3.7:- cpe:/a:kubernetes:kubernetes:1.3.7:beta0 cpe:/a:kubernetes:kubernetes:1.3.8 cpe:/a:kubernetes:kubernetes:1.3.8:- cpe:/a:kubernetes:kubernetes:1.3.8:beta0 cpe:/a:kubernetes:kubernetes:1.3.9 cpe:/a:kubernetes:kubernetes:1.3.9:- cpe:/a:kubernetes:kubernetes:1.3.9:beta0 cpe:/a:kubernetes:kubernetes:1.3.10 cpe:/a:kubernetes:kubernetes:1.3.10:- cpe:/a:kubernetes:kubernetes:1.3.10:beta0 cpe:/a:kubernetes:kubernetes:1.3.11:beta0 cpe:/a:kubernetes:kubernetes:1.4.0 cpe:/a:kubernetes:kubernetes:1.4.0:- cpe:/a:kubernetes:kubernetes:1.4.0:alpha0 cpe:/a:kubernetes:kubernetes:1.4.0:alpha1 cpe:/a:kubernetes:kubernetes:1.4.0:alpha2 cpe:/a:kubernetes:kubernetes:1.4.0:alpha3 cpe:/a:kubernetes:kubernetes:1.4.0:beta0 cpe:/a:kubernetes:kubernetes:1.4.0:beta1 cpe:/a:kubernetes:kubernetes:1.4.0:beta10 cpe:/a:kubernetes:kubernetes:1.4.0:beta11 cpe:/a:kubernetes:kubernetes:1.4.0:beta2 cpe:/a:kubernetes:kubernetes:1.4.0:beta3 cpe:/a:kubernetes:kubernetes:1.4.0:beta4 cpe:/a:kubernetes:kubernetes:1.4.0:beta5 cpe:/a:kubernetes:kubernetes:1.4.0:beta6 cpe:/a:kubernetes:kubernetes:1.4.0:beta7 cpe:/a:kubernetes:kubernetes:1.4.0:beta8 cpe:/a:kubernetes:kubernetes:1.4.0:beta9 cpe:/a:kubernetes:kubernetes:1.4.1 cpe:/a:kubernetes:kubernetes:1.4.1:- cpe:/a:kubernetes:kubernetes:1.4.1:beta0 cpe:/a:kubernetes:kubernetes:1.4.1:beta1 cpe:/a:kubernetes:kubernetes:1.4.1:beta2 cpe:/a:kubernetes:kubernetes:1.4.2 cpe:/a:kubernetes:kubernetes:1.4.2:- cpe:/a:kubernetes:kubernetes:1.4.2:beta0 cpe:/a:kubernetes:kubernetes:1.4.2:beta1 cpe:/a:kubernetes:kubernetes:1.4.3 cpe:/a:kubernetes:kubernetes:1.4.3:- cpe:/a:kubernetes:kubernetes:1.4.3:beta0 cpe:/a:kubernetes:kubernetes:1.4.4 cpe:/a:kubernetes:kubernetes:1.4.4:- cpe:/a:kubernetes:kubernetes:1.4.4:beta0 cpe:/a:kubernetes:kubernetes:1.4.5 cpe:/a:kubernetes:kubernetes:1.4.5:- cpe:/a:kubernetes:kubernetes:1.4.5:beta0 cpe:/a:kubernetes:kubernetes:1.4.6 cpe:/a:kubernetes:kubernetes:1.4.6:- cpe:/a:kubernetes:kubernetes:1.4.6:beta0 cpe:/a:kubernetes:kubernetes:1.4.7 cpe:/a:kubernetes:kubernetes:1.4.7:- cpe:/a:kubernetes:kubernetes:1.4.7:beta0 cpe:/a:kubernetes:kubernetes:1.4.8 cpe:/a:kubernetes:kubernetes:1.4.8:- cpe:/a:kubernetes:kubernetes:1.4.8:beta0 cpe:/a:kubernetes:kubernetes:1.4.9 cpe:/a:kubernetes:kubernetes:1.4.9:- cpe:/a:kubernetes:kubernetes:1.4.9:beta0 cpe:/a:kubernetes:kubernetes:1.4.11:beta0 cpe:/a:kubernetes:kubernetes:1.4.12 cpe:/a:kubernetes:kubernetes:1.4.12:- cpe:/a:kubernetes:kubernetes:1.4.12:beta0 cpe:/a:kubernetes:kubernetes:1.5.0 cpe:/a:kubernetes:kubernetes:1.5.0:- cpe:/a:kubernetes:kubernetes:1.5.0:alpha0 cpe:/a:kubernetes:kubernetes:1.5.0:alpha1 cpe:/a:kubernetes:kubernetes:1.5.0:alpha2 cpe:/a:kubernetes:kubernetes:1.5.0:beta0 cpe:/a:kubernetes:kubernetes:1.5.0:beta1 cpe:/a:kubernetes:kubernetes:1.5.0:beta2 cpe:/a:kubernetes:kubernetes:1.5.0:beta3 cpe:/a:kubernetes:kubernetes:1.5.1 cpe:/a:kubernetes:kubernetes:1.5.1:- cpe:/a:kubernetes:kubernetes:1.5.1:beta0 cpe:/a:kubernetes:kubernetes:1.5.2 cpe:/a:kubernetes:kubernetes:1.5.2:- cpe:/a:kubernetes:kubernetes:1.5.2:beta0 cpe:/a:kubernetes:kubernetes:1.5.3 cpe:/a:kubernetes:kubernetes:1.5.3:- cpe:/a:kubernetes:kubernetes:1.5.3:beta0 cpe:/a:kubernetes:kubernetes:1.5.4 cpe:/a:kubernetes:kubernetes:1.5.4:- cpe:/a:kubernetes:kubernetes:1.5.4:beta0 cpe:/a:kubernetes:kubernetes:1.5.5 cpe:/a:kubernetes:kubernetes:1.5.5:- cpe:/a:kubernetes:kubernetes:1.5.5:beta0 cpe:/a:kubernetes:kubernetes:1.5.6 cpe:/a:kubernetes:kubernetes:1.5.6:- cpe:/a:kubernetes:kubernetes:1.5.6:beta0 cpe:/a:kubernetes:kubernetes:1.5.7 cpe:/a:kubernetes:kubernetes:1.5.7:- cpe:/a:kubernetes:kubernetes:1.5.7:beta0 cpe:/a:kubernetes:kubernetes:1.5.8 cpe:/a:kubernetes:kubernetes:1.5.8:- cpe:/a:kubernetes:kubernetes:1.5.8:beta0 cpe:/a:kubernetes:kubernetes:1.5.9 cpe:/a:kubernetes:kubernetes:1.5.9:- cpe:/a:kubernetes:kubernetes:1.5.9:beta0 cpe:/a:kubernetes:kubernetes:1.6.0 cpe:/a:kubernetes:kubernetes:1.6.0:- cpe:/a:kubernetes:kubernetes:1.6.0:alpha0 cpe:/a:kubernetes:kubernetes:1.6.0:alpha1 cpe:/a:kubernetes:kubernetes:1.6.0:alpha2 cpe:/a:kubernetes:kubernetes:1.6.0:alpha3 cpe:/a:kubernetes:kubernetes:1.6.0:beta0 cpe:/a:kubernetes:kubernetes:1.6.0:beta1 cpe:/a:kubernetes:kubernetes:1.6.0:beta2 cpe:/a:kubernetes:kubernetes:1.6.0:beta3 cpe:/a:kubernetes:kubernetes:1.6.0:beta4 cpe:/a:kubernetes:kubernetes:1.6.0:rc1 cpe:/a:kubernetes:kubernetes:1.6.1 cpe:/a:kubernetes:kubernetes:1.6.1:- cpe:/a:kubernetes:kubernetes:1.6.1:beta0 cpe:/a:kubernetes:kubernetes:1.6.2 cpe:/a:kubernetes:kubernetes:1.6.2:- cpe:/a:kubernetes:kubernetes:1.6.2:beta0 cpe:/a:kubernetes:kubernetes:1.6.3 cpe:/a:kubernetes:kubernetes:1.6.3:- cpe:/a:kubernetes:kubernetes:1.6.3:beta0 cpe:/a:kubernetes:kubernetes:1.6.3:beta1 cpe:/a:kubernetes:kubernetes:1.6.4 cpe:/a:kubernetes:kubernetes:1.6.4:- cpe:/a:kubernetes:kubernetes:1.6.4:beta0 cpe:/a:kubernetes:kubernetes:1.6.4:beta1 cpe:/a:kubernetes:kubernetes:1.6.5 cpe:/a:kubernetes:kubernetes:1.6.5:- cpe:/a:kubernetes:kubernetes:1.6.5:beta0 cpe:/a:kubernetes:kubernetes:1.6.6 cpe:/a:kubernetes:kubernetes:1.6.6:- cpe:/a:kubernetes:kubernetes:1.6.6:beta0 cpe:/a:kubernetes:kubernetes:1.6.7 cpe:/a:kubernetes:kubernetes:1.6.7:- cpe:/a:kubernetes:kubernetes:1.6.7:beta0 cpe:/a:kubernetes:kubernetes:1.6.8 cpe:/a:kubernetes:kubernetes:1.6.8:- cpe:/a:kubernetes:kubernetes:1.6.8:beta0 cpe:/a:kubernetes:kubernetes:1.6.9 cpe:/a:kubernetes:kubernetes:1.6.9:- cpe:/a:kubernetes:kubernetes:1.6.9:beta0 cpe:/a:kubernetes:kubernetes:1.6.10 cpe:/a:kubernetes:kubernetes:1.6.10:- cpe:/a:kubernetes:kubernetes:1.6.10:beta0 cpe:/a:kubernetes:kubernetes:1.6.11 cpe:/a:kubernetes:kubernetes:1.6.11:- cpe:/a:kubernetes:kubernetes:1.6.11:beta0 cpe:/a:kubernetes:kubernetes:1.6.12 cpe:/a:kubernetes:kubernetes:1.6.12:- cpe:/a:kubernetes:kubernetes:1.6.12:beta0 cpe:/a:kubernetes:kubernetes:1.6.13 cpe:/a:kubernetes:kubernetes:1.6.13:- cpe:/a:kubernetes:kubernetes:1.6.13:beta0 cpe:/a:kubernetes:kubernetes:1.6.14 cpe:/a:kubernetes:kubernetes:1.6.14:- cpe:/a:kubernetes:kubernetes:1.6.14:beta0 cpe:/a:kubernetes:kubernetes:1.7.0 cpe:/a:kubernetes:kubernetes:1.7.0:- cpe:/a:kubernetes:kubernetes:1.7.0:alpha0 cpe:/a:kubernetes:kubernetes:1.7.0:alpha1 cpe:/a:kubernetes:kubernetes:1.7.0:alpha2 cpe:/a:kubernetes:kubernetes:1.7.0:alpha3 cpe:/a:kubernetes:kubernetes:1.7.0:alpha4 cpe:/a:kubernetes:kubernetes:1.7.0:beta0 cpe:/a:kubernetes:kubernetes:1.7.0:beta1 cpe:/a:kubernetes:kubernetes:1.7.0:beta2 cpe:/a:kubernetes:kubernetes:1.7.0:beta3 cpe:/a:kubernetes:kubernetes:1.7.0:rc1 cpe:/a:kubernetes:kubernetes:1.7.1 cpe:/a:kubernetes:kubernetes:1.7.1:- cpe:/a:kubernetes:kubernetes:1.7.1:beta0 cpe:/a:kubernetes:kubernetes:1.7.2 cpe:/a:kubernetes:kubernetes:1.7.2:- cpe:/a:kubernetes:kubernetes:1.7.2:beta0 cpe:/a:kubernetes:kubernetes:1.7.3 cpe:/a:kubernetes:kubernetes:1.7.3:- cpe:/a:kubernetes:kubernetes:1.7.3:beta0 cpe:/a:kubernetes:kubernetes:1.7.4 cpe:/a:kubernetes:kubernetes:1.7.4:- cpe:/a:kubernetes:kubernetes:1.7.4:beta0 cpe:/a:kubernetes:kubernetes:1.7.5 cpe:/a:kubernetes:kubernetes:1.7.5:- cpe:/a:kubernetes:kubernetes:1.7.5:beta0 cpe:/a:kubernetes:kubernetes:1.7.6 cpe:/a:kubernetes:kubernetes:1.7.6:- cpe:/a:kubernetes:kubernetes:1.7.6:beta0 cpe:/a:kubernetes:kubernetes:1.7.7 cpe:/a:kubernetes:kubernetes:1.7.7:- cpe:/a:kubernetes:kubernetes:1.7.7:beta0 cpe:/a:kubernetes:kubernetes:1.7.8 cpe:/a:kubernetes:kubernetes:1.7.8:- cpe:/a:kubernetes:kubernetes:1.7.8:beta0 cpe:/a:kubernetes:kubernetes:1.7.9 cpe:/a:kubernetes:kubernetes:1.7.9:- cpe:/a:kubernetes:kubernetes:1.7.9:beta0 cpe:/a:kubernetes:kubernetes:1.7.10 cpe:/a:kubernetes:kubernetes:1.7.10:- cpe:/a:kubernetes:kubernetes:1.7.10:beta0 cpe:/a:kubernetes:kubernetes:1.7.11 cpe:/a:kubernetes:kubernetes:1.7.11:- cpe:/a:kubernetes:kubernetes:1.7.11:beta0 cpe:/a:kubernetes:kubernetes:1.7.12 cpe:/a:kubernetes:kubernetes:1.7.12:- cpe:/a:kubernetes:kubernetes:1.7.12:beta0 cpe:/a:kubernetes:kubernetes:1.7.13 cpe:/a:kubernetes:kubernetes:1.7.13:- cpe:/a:kubernetes:kubernetes:1.7.13:beta0 cpe:/a:kubernetes:kubernetes:1.7.14 cpe:/a:kubernetes:kubernetes:1.7.14:- cpe:/a:kubernetes:kubernetes:1.7.14:beta0 cpe:/a:kubernetes:kubernetes:1.7.15 cpe:/a:kubernetes:kubernetes:1.7.15:- cpe:/a:kubernetes:kubernetes:1.7.15:beta0 cpe:/a:kubernetes:kubernetes:1.7.16 cpe:/a:kubernetes:kubernetes:1.7.16:- cpe:/a:kubernetes:kubernetes:1.7.16:beta0 cpe:/a:kubernetes:kubernetes:1.7.17 cpe:/a:kubernetes:kubernetes:1.7.17:- cpe:/a:kubernetes:kubernetes:1.7.17:beta0 cpe:/a:kubernetes:kubernetes:1.8.0 cpe:/a:kubernetes:kubernetes:1.8.0:- cpe:/a:kubernetes:kubernetes:1.8.0:alpha0 cpe:/a:kubernetes:kubernetes:1.8.0:alpha1 cpe:/a:kubernetes:kubernetes:1.8.0:alpha2 cpe:/a:kubernetes:kubernetes:1.8.0:alpha3 cpe:/a:kubernetes:kubernetes:1.8.0:beta0 cpe:/a:kubernetes:kubernetes:1.8.0:beta1 cpe:/a:kubernetes:kubernetes:1.8.0:rc1 cpe:/a:kubernetes:kubernetes:1.8.1 cpe:/a:kubernetes:kubernetes:1.8.1:- cpe:/a:kubernetes:kubernetes:1.8.1:beta0 cpe:/a:kubernetes:kubernetes:1.8.2 cpe:/a:kubernetes:kubernetes:1.8.2:- cpe:/a:kubernetes:kubernetes:1.8.2:beta0 cpe:/a:kubernetes:kubernetes:1.8.3 cpe:/a:kubernetes:kubernetes:1.8.3:- cpe:/a:kubernetes:kubernetes:1.8.3:beta0 cpe:/a:kubernetes:kubernetes:1.8.4 cpe:/a:kubernetes:kubernetes:1.8.4:- cpe:/a:kubernetes:kubernetes:1.8.4:beta0 cpe:/a:kubernetes:kubernetes:1.8.5 cpe:/a:kubernetes:kubernetes:1.8.5:- cpe:/a:kubernetes:kubernetes:1.8.5:beta0 cpe:/a:kubernetes:kubernetes:1.8.6 cpe:/a:kubernetes:kubernetes:1.8.6:- cpe:/a:kubernetes:kubernetes:1.8.6:beta0 cpe:/a:kubernetes:kubernetes:1.8.7 cpe:/a:kubernetes:kubernetes:1.8.7:- cpe:/a:kubernetes:kubernetes:1.8.7:beta0 cpe:/a:kubernetes:kubernetes:1.8.8 cpe:/a:kubernetes:kubernetes:1.8.8:- cpe:/a:kubernetes:kubernetes:1.8.8:beta0 cpe:/a:kubernetes:kubernetes:1.8.9 cpe:/a:kubernetes:kubernetes:1.8.9:- cpe:/a:kubernetes:kubernetes:1.8.9:beta0 cpe:/a:kubernetes:kubernetes:1.8.10 cpe:/a:kubernetes:kubernetes:1.8.10:- cpe:/a:kubernetes:kubernetes:1.8.10:beta0 cpe:/a:kubernetes:kubernetes:1.8.11 cpe:/a:kubernetes:kubernetes:1.8.11:- cpe:/a:kubernetes:kubernetes:1.8.11:beta0 cpe:/a:kubernetes:kubernetes:1.8.12 cpe:/a:kubernetes:kubernetes:1.8.12:- cpe:/a:kubernetes:kubernetes:1.8.12:beta0 cpe:/a:kubernetes:kubernetes:1.8.13 cpe:/a:kubernetes:kubernetes:1.8.13:- cpe:/a:kubernetes:kubernetes:1.8.13:beta0 cpe:/a:kubernetes:kubernetes:1.8.14 cpe:/a:kubernetes:kubernetes:1.8.14:- cpe:/a:kubernetes:kubernetes:1.8.14:beta0 cpe:/a:kubernetes:kubernetes:1.8.15 cpe:/a:kubernetes:kubernetes:1.8.15:- cpe:/a:kubernetes:kubernetes:1.8.15:beta0 cpe:/a:kubernetes:kubernetes:1.8.16:beta0 cpe:/a:kubernetes:kubernetes:1.9.0 cpe:/a:kubernetes:kubernetes:1.9.0:- cpe:/a:kubernetes:kubernetes:1.9.0:alpha0 cpe:/a:kubernetes:kubernetes:1.9.0:alpha1 cpe:/a:kubernetes:kubernetes:1.9.0:alpha2 cpe:/a:kubernetes:kubernetes:1.9.0:alpha3 cpe:/a:kubernetes:kubernetes:1.9.0:beta0 cpe:/a:kubernetes:kubernetes:1.9.0:beta1 cpe:/a:kubernetes:kubernetes:1.9.0:beta2 cpe:/a:kubernetes:kubernetes:1.9.1 cpe:/a:kubernetes:kubernetes:1.9.1:- cpe:/a:kubernetes:kubernetes:1.9.1:beta0 cpe:/a:kubernetes:kubernetes:1.9.2 cpe:/a:kubernetes:kubernetes:1.9.2:- cpe:/a:kubernetes:kubernetes:1.9.2:beta0 cpe:/a:kubernetes:kubernetes:1.9.3 cpe:/a:kubernetes:kubernetes:1.9.3:- cpe:/a:kubernetes:kubernetes:1.9.3:beta0 cpe:/a:kubernetes:kubernetes:1.9.4 cpe:/a:kubernetes:kubernetes:1.9.4:- cpe:/a:kubernetes:kubernetes:1.9.4:beta0 cpe:/a:kubernetes:kubernetes:1.9.5 cpe:/a:kubernetes:kubernetes:1.9.5:- cpe:/a:kubernetes:kubernetes:1.9.5:beta0 cpe:/a:kubernetes:kubernetes:1.9.6 cpe:/a:kubernetes:kubernetes:1.9.6:- cpe:/a:kubernetes:kubernetes:1.9.6:beta0 cpe:/a:kubernetes:kubernetes:1.9.7 cpe:/a:kubernetes:kubernetes:1.9.7:- cpe:/a:kubernetes:kubernetes:1.9.7:beta0 cpe:/a:kubernetes:kubernetes:1.9.8 cpe:/a:kubernetes:kubernetes:1.9.8:- cpe:/a:kubernetes:kubernetes:1.9.8:beta0 cpe:/a:kubernetes:kubernetes:1.9.9 cpe:/a:kubernetes:kubernetes:1.9.9:- cpe:/a:kubernetes:kubernetes:1.9.9:beta0 cpe:/a:kubernetes:kubernetes:1.9.10 cpe:/a:kubernetes:kubernetes:1.9.10:- cpe:/a:kubernetes:kubernetes:1.9.10:beta0 cpe:/a:kubernetes:kubernetes:1.9.11 cpe:/a:kubernetes:kubernetes:1.9.11:- cpe:/a:kubernetes:kubernetes:1.9.11:beta0 cpe:/a:kubernetes:kubernetes:1.9.12:beta0 cpe:/a:kubernetes:kubernetes:1.10.0 cpe:/a:kubernetes:kubernetes:1.10.0:- cpe:/a:kubernetes:kubernetes:1.10.0:alpha0 cpe:/a:kubernetes:kubernetes:1.10.0:alpha1 cpe:/a:kubernetes:kubernetes:1.10.0:alpha2 cpe:/a:kubernetes:kubernetes:1.10.0:alpha3 cpe:/a:kubernetes:kubernetes:1.10.0:beta0 cpe:/a:kubernetes:kubernetes:1.10.0:beta1 cpe:/a:kubernetes:kubernetes:1.10.0:beta2 cpe:/a:kubernetes:kubernetes:1.10.0:beta3 cpe:/a:kubernetes:kubernetes:1.10.0:beta4 cpe:/a:kubernetes:kubernetes:1.10.0:rc1 cpe:/a:kubernetes:kubernetes:1.10.1 cpe:/a:kubernetes:kubernetes:1.10.1:- cpe:/a:kubernetes:kubernetes:1.10.1:beta0 cpe:/a:kubernetes:kubernetes:1.10.2 cpe:/a:kubernetes:kubernetes:1.10.2:- cpe:/a:kubernetes:kubernetes:1.10.2:beta0 cpe:/a:kubernetes:kubernetes:1.10.3 cpe:/a:kubernetes:kubernetes:1.10.3:- cpe:/a:kubernetes:kubernetes:1.10.3:beta0 cpe:/a:kubernetes:kubernetes:1.10.4 cpe:/a:kubernetes:kubernetes:1.10.4:- cpe:/a:kubernetes:kubernetes:1.10.4:beta0 cpe:/a:kubernetes:kubernetes:1.10.5 cpe:/a:kubernetes:kubernetes:1.10.5:- cpe:/a:kubernetes:kubernetes:1.10.5:beta0 cpe:/a:kubernetes:kubernetes:1.10.6 cpe:/a:kubernetes:kubernetes:1.10.6:- cpe:/a:kubernetes:kubernetes:1.10.6:beta0 cpe:/a:kubernetes:kubernetes:1.10.7 cpe:/a:kubernetes:kubernetes:1.10.7:- cpe:/a:kubernetes:kubernetes:1.10.7:beta0 cpe:/a:kubernetes:kubernetes:1.10.8 cpe:/a:kubernetes:kubernetes:1.10.8:- cpe:/a:kubernetes:kubernetes:1.10.8:beta0 cpe:/a:kubernetes:kubernetes:1.10.9 cpe:/a:kubernetes:kubernetes:1.10.9:- cpe:/a:kubernetes:kubernetes:1.10.9:beta0 cpe:/a:kubernetes:kubernetes:1.10.10 cpe:/a:kubernetes:kubernetes:1.10.10:- cpe:/a:kubernetes:kubernetes:1.10.10:beta0 cpe:/a:kubernetes:kubernetes:1.10.11 cpe:/a:kubernetes:kubernetes:1.10.11:- cpe:/a:kubernetes:kubernetes:1.10.11:beta0 cpe:/a:kubernetes:kubernetes:1.10.12 cpe:/a:kubernetes:kubernetes:1.10.12:- cpe:/a:kubernetes:kubernetes:1.10.12:beta0 cpe:/a:kubernetes:kubernetes:1.10.13:beta0 cpe:/a:kubernetes:kubernetes:1.11.0 cpe:/a:kubernetes:kubernetes:1.11.0:- cpe:/a:kubernetes:kubernetes:1.11.0:alpha0 cpe:/a:kubernetes:kubernetes:1.11.0:alpha1 cpe:/a:kubernetes:kubernetes:1.11.0:alpha2 cpe:/a:kubernetes:kubernetes:1.11.0:beta0 cpe:/a:kubernetes:kubernetes:1.11.0:beta1 cpe:/a:kubernetes:kubernetes:1.11.0:beta2 cpe:/a:kubernetes:kubernetes:1.11.0:rc1 cpe:/a:kubernetes:kubernetes:1.11.0:rc2 cpe:/a:kubernetes:kubernetes:1.11.0:rc3 cpe:/a:kubernetes:kubernetes:1.11.1 cpe:/a:kubernetes:kubernetes:1.11.1:- cpe:/a:kubernetes:kubernetes:1.11.1:beta0 cpe:/a:kubernetes:kubernetes:1.11.2 cpe:/a:kubernetes:kubernetes:1.11.2:- cpe:/a:kubernetes:kubernetes:1.11.2:beta0 cpe:/a:kubernetes:kubernetes:1.11.3 cpe:/a:kubernetes:kubernetes:1.11.3:- cpe:/a:kubernetes:kubernetes:1.11.3:beta0 cpe:/a:kubernetes:kubernetes:1.11.4 cpe:/a:kubernetes:kubernetes:1.11.4:- cpe:/a:kubernetes:kubernetes:1.11.4:beta0 cpe:/a:kubernetes:kubernetes:1.11.5 cpe:/a:kubernetes:kubernetes:1.11.5:- cpe:/a:kubernetes:kubernetes:1.11.5:beta0 cpe:/a:kubernetes:kubernetes:1.11.6 cpe:/a:kubernetes:kubernetes:1.11.6:- cpe:/a:kubernetes:kubernetes:1.11.6:beta0 cpe:/a:kubernetes:kubernetes:1.11.7 cpe:/a:kubernetes:kubernetes:1.11.7:- cpe:/a:kubernetes:kubernetes:1.11.7:beta0 cpe:/a:kubernetes:kubernetes:1.12.0 cpe:/a:kubernetes:kubernetes:1.12.0:- cpe:/a:kubernetes:kubernetes:1.12.0:alpha0 cpe:/a:kubernetes:kubernetes:1.12.0:alpha1 cpe:/a:kubernetes:kubernetes:1.12.0:beta0 cpe:/a:kubernetes:kubernetes:1.12.0:beta1 cpe:/a:kubernetes:kubernetes:1.12.0:beta2 cpe:/a:kubernetes:kubernetes:1.12.0:rc1 cpe:/a:kubernetes:kubernetes:1.12.0:rc2 cpe:/a:kubernetes:kubernetes:1.12.1 cpe:/a:kubernetes:kubernetes:1.12.1:- cpe:/a:kubernetes:kubernetes:1.12.1:beta0 cpe:/a:kubernetes:kubernetes:1.12.2 cpe:/a:kubernetes:kubernetes:1.12.2:- cpe:/a:kubernetes:kubernetes:1.12.2:beta0 cpe:/a:kubernetes:kubernetes:1.12.3 cpe:/a:kubernetes:kubernetes:1.12.3:- cpe:/a:kubernetes:kubernetes:1.12.3:beta0 cpe:/a:kubernetes:kubernetes:1.12.4 cpe:/a:kubernetes:kubernetes:1.12.4:- cpe:/a:kubernetes:kubernetes:1.12.4:beta0 cpe:/a:kubernetes:kubernetes:1.12.5 cpe:/a:kubernetes:kubernetes:1.12.5:- cpe:/a:kubernetes:kubernetes:1.12.5:beta0 cpe:/a:kubernetes:kubernetes:1.13.0 cpe:/a:kubernetes:kubernetes:1.13.0:- cpe:/a:kubernetes:kubernetes:1.13.0:alpha.0 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.1 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.2 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.3 cpe:/a:kubernetes:kubernetes:1.13.0:alpha0 cpe:/a:kubernetes:kubernetes:1.13.0:alpha1 cpe:/a:kubernetes:kubernetes:1.13.0:alpha2 cpe:/a:kubernetes:kubernetes:1.13.0:alpha3 cpe:/a:kubernetes:kubernetes:1.13.0:beta.0 cpe:/a:kubernetes:kubernetes:1.13.0:beta.1 cpe:/a:kubernetes:kubernetes:1.13.0:beta0 cpe:/a:kubernetes:kubernetes:1.13.0:beta1 cpe:/a:kubernetes:kubernetes:1.13.0:beta2 cpe:/a:kubernetes:kubernetes:1.13.0:rc.1 cpe:/a:kubernetes:kubernetes:1.13.0:rc.2 cpe:/a:kubernetes:kubernetes:1.13.0:rc1 cpe:/a:kubernetes:kubernetes:1.13.0:rc2 cpe:/a:kubernetes:kubernetes:1.13.1 cpe:/a:kubernetes:kubernetes:1.13.1:- cpe:/a:kubernetes:kubernetes:1.13.1:beta.0 cpe:/a:kubernetes:kubernetes:1.13.1:beta0 cpe:/a:kubernetes:kubernetes:1.13.2 cpe:/a:kubernetes:kubernetes:1.13.2:- cpe:/a:kubernetes:kubernetes:1.13.2:beta.0 cpe:/a:kubernetes:kubernetes:1.13.2:beta0 cpe:/a:kubernetes:kubernetes:1.13.3:-:~~~-~~ cpe:/a:kubernetes:kubernetes:1.13.3:beta.0 cpe:/a:kubernetes:kubernetes:1.13.3:beta0

CVE-2019-1002100

2019-04-01T10:29:00.483-04:00

2019-04-16T02:29:04.660-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov BID 107290 REDHAT RHSA-2019:1851 CONFIRM https://github.com/kubernetes/kubernetes/issues/74534 CONFIRM https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g CONFIRM https://security.netapp.com/advisory/ntap-20190416-0002/ In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

cpe:/a:kubernetes:kubernetes:1.11.0 cpe:/a:kubernetes:kubernetes:1.11.0:- cpe:/a:kubernetes:kubernetes:1.11.0:alpha0 cpe:/a:kubernetes:kubernetes:1.11.0:alpha1 cpe:/a:kubernetes:kubernetes:1.11.0:alpha2 cpe:/a:kubernetes:kubernetes:1.11.0:beta0 cpe:/a:kubernetes:kubernetes:1.11.0:beta1 cpe:/a:kubernetes:kubernetes:1.11.0:beta2 cpe:/a:kubernetes:kubernetes:1.11.0:rc1 cpe:/a:kubernetes:kubernetes:1.11.0:rc2 cpe:/a:kubernetes:kubernetes:1.11.0:rc3 cpe:/a:kubernetes:kubernetes:1.11.1 cpe:/a:kubernetes:kubernetes:1.11.1:- cpe:/a:kubernetes:kubernetes:1.11.1:beta0 cpe:/a:kubernetes:kubernetes:1.11.2 cpe:/a:kubernetes:kubernetes:1.11.2:- cpe:/a:kubernetes:kubernetes:1.11.2:beta0 cpe:/a:kubernetes:kubernetes:1.11.3 cpe:/a:kubernetes:kubernetes:1.11.3:- cpe:/a:kubernetes:kubernetes:1.11.3:beta0 cpe:/a:kubernetes:kubernetes:1.11.4 cpe:/a:kubernetes:kubernetes:1.11.4:- cpe:/a:kubernetes:kubernetes:1.11.4:beta0 cpe:/a:kubernetes:kubernetes:1.11.5 cpe:/a:kubernetes:kubernetes:1.11.5:- cpe:/a:kubernetes:kubernetes:1.11.5:beta0 cpe:/a:kubernetes:kubernetes:1.11.6 cpe:/a:kubernetes:kubernetes:1.11.6:- cpe:/a:kubernetes:kubernetes:1.11.6:beta0 cpe:/a:kubernetes:kubernetes:1.11.7 cpe:/a:kubernetes:kubernetes:1.11.7:- cpe:/a:kubernetes:kubernetes:1.11.7:beta0 cpe:/a:kubernetes:kubernetes:1.11.8:beta0 cpe:/a:kubernetes:kubernetes:1.12.0 cpe:/a:kubernetes:kubernetes:1.12.0:- cpe:/a:kubernetes:kubernetes:1.12.0:alpha0 cpe:/a:kubernetes:kubernetes:1.12.0:alpha1 cpe:/a:kubernetes:kubernetes:1.12.0:beta0 cpe:/a:kubernetes:kubernetes:1.12.0:beta1 cpe:/a:kubernetes:kubernetes:1.12.0:beta2 cpe:/a:kubernetes:kubernetes:1.12.0:rc1 cpe:/a:kubernetes:kubernetes:1.12.0:rc2 cpe:/a:kubernetes:kubernetes:1.12.1 cpe:/a:kubernetes:kubernetes:1.12.1:- cpe:/a:kubernetes:kubernetes:1.12.1:beta0 cpe:/a:kubernetes:kubernetes:1.12.2 cpe:/a:kubernetes:kubernetes:1.12.2:- cpe:/a:kubernetes:kubernetes:1.12.2:beta0 cpe:/a:kubernetes:kubernetes:1.12.3 cpe:/a:kubernetes:kubernetes:1.12.3:- cpe:/a:kubernetes:kubernetes:1.12.3:beta0 cpe:/a:kubernetes:kubernetes:1.12.4 cpe:/a:kubernetes:kubernetes:1.12.4:- cpe:/a:kubernetes:kubernetes:1.12.4:beta0 cpe:/a:kubernetes:kubernetes:1.12.5 cpe:/a:kubernetes:kubernetes:1.12.5:- cpe:/a:kubernetes:kubernetes:1.12.5:beta0 cpe:/a:kubernetes:kubernetes:1.12.6:beta0 cpe:/a:kubernetes:kubernetes:1.13.0 cpe:/a:kubernetes:kubernetes:1.13.0:- cpe:/a:kubernetes:kubernetes:1.13.0:alpha.0 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.1 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.2 cpe:/a:kubernetes:kubernetes:1.13.0:alpha.3 cpe:/a:kubernetes:kubernetes:1.13.0:alpha0 cpe:/a:kubernetes:kubernetes:1.13.0:alpha1 cpe:/a:kubernetes:kubernetes:1.13.0:alpha2 cpe:/a:kubernetes:kubernetes:1.13.0:alpha3 cpe:/a:kubernetes:kubernetes:1.13.0:beta.0 cpe:/a:kubernetes:kubernetes:1.13.0:beta.1 cpe:/a:kubernetes:kubernetes:1.13.0:beta0 cpe:/a:kubernetes:kubernetes:1.13.0:beta1 cpe:/a:kubernetes:kubernetes:1.13.0:beta2 cpe:/a:kubernetes:kubernetes:1.13.0:rc.1 cpe:/a:kubernetes:kubernetes:1.13.0:rc.2 cpe:/a:kubernetes:kubernetes:1.13.0:rc1 cpe:/a:kubernetes:kubernetes:1.13.0:rc2 cpe:/a:kubernetes:kubernetes:1.13.1 cpe:/a:kubernetes:kubernetes:1.13.1:- cpe:/a:kubernetes:kubernetes:1.13.1:beta.0 cpe:/a:kubernetes:kubernetes:1.13.1:beta0 cpe:/a:kubernetes:kubernetes:1.13.2 cpe:/a:kubernetes:kubernetes:1.13.2:- cpe:/a:kubernetes:kubernetes:1.13.2:beta.0 cpe:/a:kubernetes:kubernetes:1.13.2:beta0 cpe:/a:kubernetes:kubernetes:1.13.3:-:~~~-~~ cpe:/a:kubernetes:kubernetes:1.13.3:beta.0 cpe:/a:kubernetes:kubernetes:1.13.3:beta0 cpe:/a:kubernetes:kubernetes:1.13.4::~~~-~~ cpe:/a:kubernetes:kubernetes:1.13.4:beta.0 cpe:/a:kubernetes:kubernetes:1.14.0 cpe:/a:redhat:openshift_container_platform:3.9 cpe:/a:redhat:openshift_container_platform:3.10 cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1002101

2019-04-01T10:29:00.640-04:00

2019-10-10T08:08:39.020-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20190620 [ANNOUNCE] Incomplete fixes for CVE-2019-1002101, kubectl cp potential directory traversal - CVE-2019-11246 MLIST [oss-security] 20190805 Kubernetes v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249 BID 107652 REDHAT RHBA-2019:0619 REDHAT RHBA-2019:0620 REDHAT RHBA-2019:0636 MISC CVE-2019-1002101 MISC https://github.com/kubernetes/kubernetes/pull/75037 FEDORA FEDORA-2019-bf800b1c04 FEDORA FEDORA-2019-2b8ef08c95 The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user?s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user?s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10022

2019-03-24T20:29:05.697-04:00

2019-03-25T16:26:09.967-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-25T15:04:57.733-04:00

MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41273 An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10023

2019-03-24T20:29:05.730-04:00

2019-06-27T12:15:11.837-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10024

2019-03-24T20:29:05.760-04:00

2019-03-25T16:21:51.430-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-25T14:53:48.680-04:00

MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10025

2019-03-24T20:29:05.807-04:00

2019-03-25T16:21:12.197-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-25T14:51:32.560-04:00

MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits.

cpe:/a:xpdfreader:xpdf:4.01.01

CVE-2019-10026

2019-03-24T20:29:05.840-04:00

2019-03-25T16:20:45.570-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-25T14:50:51.760-04:00

MISC https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276 An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case.

cpe:/a:phpcms:phpcms:9.6.0 cpe:/a:phpcms:phpcms:9.6.1 cpe:/a:phpcms:phpcms:9.6.2 cpe:/a:phpcms:phpcms:9.6.3

CVE-2019-10027

2019-03-24T20:29:05.870-04:00

2019-03-26T13:27:11.870-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T12:44:27.090-04:00

MISC https://github.com/sharemice/phpcms_xss/blob/master/index.html MISC https://sharemice.github.io/phpcms_xss/ PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.

CVE-2019-10028

2019-06-21T17:15:09.710-04:00

2019-06-24T13:07:18.727-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-24T12:26:50.473-04:00

CONFIRM https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2019-002.md Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.

CVE-2019-1003

2019-06-12T10:29:02.523-04:00

2019-06-13T08:37:44.970-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T08:02:03.470-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1003 A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.

cpe:/a:jenkins:script_security:1.49::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003000

2019-01-22T09:29:00.267-05:00

2019-05-17T12:29:02.407-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 EXPLOIT-DB 46453 EXPLOIT-DB 46572 A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:pipeline%3a_groovy:2.61::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003001

2019-01-22T09:29:00.330-05:00

2019-10-09T19:44:00.007-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 EXPLOIT-DB 46572 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cpe:/a:jenkins:pipeline%3a_declarative:1.3.3::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003002

2019-01-22T09:29:00.390-05:00

2019-10-09T19:44:00.147-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266 EXPLOIT-DB 46572 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cpe:/a:jenkins:jenkins:2.150.1::~~lts~~~ cpe:/a:jenkins:jenkins:2.158::~~-~~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003003

2019-01-22T09:29:00.437-05:00

2019-10-09T19:44:00.337-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 106680 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-16/#SECURITY-868 An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.

cpe:/a:jenkins:jenkins:2.150.1::~~lts~~~ cpe:/a:jenkins:jenkins:2.159::~~-~~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003004

2019-01-22T09:29:00.487-05:00

2019-10-09T19:44:00.447-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 106680 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-16/#SECURITY-901 An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.

cpe:/a:jenkins:script_security:1.50::~~~jenkins~~

CVE-2019-1003005

2019-02-06T11:29:00.250-05:00

2019-04-10T19:29:00.233-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1292 A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cpe:/a:jenkins:groovy:2.0::~~~jenkins~~

CVE-2019-1003006

2019-02-06T11:29:00.407-05:00

2019-10-09T19:44:00.663-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1293 A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cpe:/a:jenkins:warnings:5.0.0::~~~jenkins~~

CVE-2019-1003007

2019-02-06T11:29:00.437-05:00

2019-10-09T19:44:00.803-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20(1) A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

cpe:/a:jenkins:warnings_next_generation:2.1.1::~~~jenkins~~

CVE-2019-1003008

2019-02-06T11:29:00.483-05:00

2019-10-09T19:44:00.947-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1295%20(2) A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/warnings/groovy/GroovyParser.java that allows attackers to execute arbitrary code via a form validation HTTP endpoint.

cpe:/a:jenkins:active_directory:2.10::~~~jenkins~~

CVE-2019-1003009

2019-02-06T11:29:00.530-05:00

2019-10-09T19:44:01.070-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-859 An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/active_directory/ActiveDirectorySecurityRealm.java, src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java that allows attackers to impersonate the Active Directory server Jenkins connects to for authentication if Jenkins is configured to use StartTLS.

cpe:/a:jenkins:git:3.9.1::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003010

2019-02-06T11:29:00.563-05:00

2019-04-26T10:01:56.520-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-04-24T09:04:51.650-04:00

REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095 A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.

cpe:/a:jenkins:token_macro:2.5::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003011

2019-02-06T11:29:00.623-05:00

2019-10-09T19:44:01.227-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102 An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

cpe:/a:jenkins:blue_ocean:1.10.1::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003012

2019-02-06T11:29:00.670-05:00

2019-10-09T19:44:01.367-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201 A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts, blueocean-core-js/src/js/i18n/i18n.js, blueocean-core-js/src/js/urlconfig.js, blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java, blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java, blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API.

cpe:/a:jenkins:blue_ocean:1.10.1::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003013

2019-02-06T11:29:00.703-05:00

2019-10-09T19:44:01.493-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204 An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.

cpe:/a:jenkins:config_file_provider:3.4.1::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003014

2019-02-06T11:29:00.733-05:00

2019-10-09T19:44:01.617-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHBA-2019:0326 REDHAT RHBA-2019:0327 CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253 An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.

cpe:/a:jenkins:job_import:2.1::~~~jenkins~~

CVE-2019-1003015

2019-02-06T11:29:00.780-05:00

2019-10-09T19:44:01.743-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(1) An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.

cpe:/a:jenkins:job_import:2.1::~~~jenkins~~

CVE-2019-1003016

2019-02-06T11:29:00.813-05:00

2019-10-09T19:44:01.867-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(2) An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

cpe:/a:jenkins:job_import:3.0::~~~jenkins~~

CVE-2019-1003017

2019-02-06T11:29:00.843-05:00

2019-10-09T19:44:01.977-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1302 A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.

cpe:/a:jenkins:github_oauth:0.29::~~~jenkins~~

CVE-2019-1003018

2019-02-06T11:29:00.890-05:00

2019-10-09T19:44:02.117-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-602 An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

cpe:/a:jenkins:github_oauth:0.29::~~~jenkins~~

CVE-2019-1003019

2019-02-06T11:29:00.920-05:00

2019-10-09T19:44:02.227-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797 An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

cpe:/a:jenkins:kanboard:1.5.10::~~~jenkins~~

CVE-2019-1003020

2019-02-06T11:29:00.953-05:00

2019-10-09T19:44:02.430-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-818 A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with Overall/Read permission to submit a GET request to an attacker-specified URL.

cpe:/a:jenkins:openid_connect_authentication:1.4::~~~jenkins~~

CVE-2019-1003021

2019-02-06T11:29:00.983-05:00

2019-10-09T19:44:02.570-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-886 An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

cpe:/a:jenkins:monitoring:1.74.0::~~~jenkins~~

CVE-2019-1003022

2019-02-06T11:29:01.030-05:00

2019-10-09T19:44:02.697-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1153 A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.

cpe:/a:jenkins:warnings_next_generation:1.0.1::~~~jenkins~~

CVE-2019-1003023

2019-02-06T11:29:01.077-05:00

2019-10-09T19:44:02.803-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271 A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.

cpe:/a:jenkins:script_security:1.52::~~~jenkins~~ cpe:/a:redhat:openshift_container_platform:3.11

CVE-2019-1003024

2019-02-20T16:29:00.270-05:00

2019-10-09T19:44:02.930-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107295 REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1320 A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

cpe:/a:jenkins:cloud_foundry:2.3.1::~~~jenkins~~

CVE-2019-1003025

2019-02-20T16:29:00.333-05:00

2019-10-09T19:44:03.053-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 107295 CONFIRM https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876 A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

cpe:/a:jenkins:mattermost:2.6.2::~~~jenkins~~

CVE-2019-1003026

2019-02-20T16:29:00.397-05:00

2019-10-09T19:44:03.180-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107295 CONFIRM https://jenkins.io/security/advisory/2019-02-19/#SECURITY-985 A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message.

cpe:/a:jenkins:octopusdeploy:1.8.1::~~~jenkins~~

CVE-2019-1003027

2019-02-20T16:29:00.443-05:00

2019-10-09T19:44:03.337-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 107295 CONFIRM https://jenkins.io/security/advisory/2019-02-19/#SECURITY-817 A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL and obtain the HTTP response code if successful, and exception error message otherwise.

cpe:/a:jenkins:jms_messaging:1.1.1::~~~jenkins~~

CVE-2019-1003028

2019-02-20T16:29:00.490-05:00

2019-10-09T19:44:03.493-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107295 CONFIRM https://jenkins.io/security/advisory/2019-02-19/#SECURITY-1033 A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthenticationMethod.java that allows attackers with Overall/Read permission to have Jenkins connect to a JMS endpoint.

cpe:/a:jenkins:script_security:1.53::~~~jenkins~~

CVE-2019-1003029

2019-03-08T16:29:00.297-05:00

2019-04-10T19:29:00.357-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(1) A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:pipeline%3a_groovy:2.63::~~~jenkins~~

CVE-2019-1003030

2019-03-08T16:29:00.343-05:00

2019-04-10T19:29:00.420-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1336%20(2) A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:matrix_project:1.13::~~~jenkins~~

CVE-2019-1003031

2019-03-08T16:29:00.373-05:00

2019-04-10T19:29:00.467-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339 A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:email_extension:2.64::~~~jenkins~~

CVE-2019-1003032

2019-03-08T16:29:00.420-05:00

2019-03-21T12:01:02.767-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1340 A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:groovy:2.1::~~~jenkins~~

CVE-2019-1003033

2019-03-08T16:29:00.467-05:00

2019-03-21T12:01:02.813-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1338 A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:job_dsl:1.71::~~~jenkins~~

CVE-2019-1003034

2019-03-08T16:29:00.500-05:00

2019-04-10T19:29:00.530-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 107476 REDHAT RHSA-2019:0739 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1342 A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

cpe:/a:jenkins:azure_vm_agents:0.8.0::~~~jenkins~~

CVE-2019-1003035

2019-03-08T16:29:00.530-05:00

2019-03-21T12:01:02.907-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1330 An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTemplate.java, src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to perform the 'verify configuration' form validation action, thereby obtaining limited information about the Azure configuration.

cpe:/a:jenkins:azure_vm_agents:0.8.0::~~~jenkins~~

CVE-2019-1003036

2019-03-08T16:29:00.560-05:00

2019-03-21T12:01:02.953-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1331 A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java that allows attackers with Overall/Read permission to attach a public IP address to an Azure VM agent.

cpe:/a:jenkins:azure_vm_agents:0.8.0::~~~jenkins~~

CVE-2019-1003037

2019-03-08T16:29:00.607-05:00

2019-10-09T19:44:04.290-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1332 An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java that allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

cpe:/a:jenkins:repository_connector:1.2.4::~~~jenkins~~

CVE-2019-1003038

2019-03-08T16:29:00.640-05:00

2019-03-21T12:01:03.047-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958 An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

cpe:/a:jenkins:appdynamics:1.0.14::~~~jenkins~~

CVE-2019-1003039

2019-03-08T16:29:00.670-05:00

2019-10-09T19:44:04.837-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 107476 CONFIRM https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1087 An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords configured in jobs to obtain them.

cpe:/a:jenkins:script_security:1.55::~~~jenkins~~

CVE-2019-1003040

2019-03-28T14:29:00.250-04:00

2019-06-10T15:29:00.357-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 REDHAT RHSA-2019:1423 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

cpe:/a:jenkins:pipeline%3a_groovy:2.64::~~~jenkins~~

CVE-2019-1003041

2019-03-28T14:29:00.313-04:00

2019-06-10T15:29:00.467-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 REDHAT RHSA-2019:1423 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1353 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

cpe:/a:jenkins:lockable_resources:2.4::~~~jenkins~~

CVE-2019-1003042

2019-03-28T14:29:00.343-04:00

2019-06-10T15:29:00.543-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 REDHAT RHSA-2019:1423 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361 A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

cpe:/a:jenkins:slack_notification:2.19::~~~jenkins~~

CVE-2019-1003043

2019-03-28T14:29:00.390-04:00

2019-10-09T19:44:05.210-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976 A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

cpe:/a:jenkins:slack_notification:2.19::~~~jenkins~~

CVE-2019-1003044

2019-03-28T14:29:00.420-04:00

2019-10-09T19:44:05.337-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-976 A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

cpe:/a:trustsource:ecs_publisher:1.0.0::~~~jenkins~~

CVE-2019-1003045

2019-03-28T14:29:00.453-04:00

2019-10-09T19:44:05.477-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-846 A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.

cpe:/a:jenkins:fortify_on_demand_uploader:3.0.10::~~~jenkins~~

CVE-2019-1003046

2019-03-28T14:29:00.500-04:00

2019-10-09T19:44:05.600-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992 A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:fortify_on_demand_uploader:3.0.10::~~~jenkins~~

CVE-2019-1003047

2019-03-28T14:29:00.530-04:00

2019-10-09T19:44:05.727-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-992 A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:prqa:3.1.0::~~~jenkins~~

CVE-2019-1003048

2019-03-28T14:29:00.563-04:00

2019-10-09T19:44:05.850-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins BID 107628 MISC https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1089 A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted password from the plugin configuration.

cpe:/a:jenkins:jenkins:2.164.1::~~lts~~~ cpe:/a:jenkins:jenkins:2.171

CVE-2019-1003049

2019-04-10T17:29:01.480-04:00

2019-04-15T09:29:00.260-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 107901 REDHAT RHBA-2019:1605 MISC https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

cpe:/a:jenkins:jenkins:2.164.1::~~lts~~~ cpe:/a:jenkins:jenkins:2.171

CVE-2019-1003050

2019-04-10T17:29:01.513-04:00

2019-04-12T10:29:00.263-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107889 REDHAT RHBA-2019:1605 MISC https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327 The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

cpe:/a:jenkins:irc:::~~~jenkins~~

CVE-2019-1003051

2019-04-04T12:29:00.447-04:00

2019-10-09T19:44:06.117-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-829 Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:aws_elastic_beanstalk_publisher:::~~~jenkins~~

CVE-2019-1003052

2019-04-04T12:29:00.493-04:00

2019-10-09T19:44:06.397-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831 Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:hockeyapp:::~~~jenkins~~

CVE-2019-1003053

2019-04-04T12:29:00.540-04:00

2019-10-09T19:44:06.553-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-839 Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:jira_issue_updater:::~~~jenkins~~

CVE-2019-1003054

2019-04-04T12:29:00.570-04:00

2019-10-09T19:44:06.663-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-837 Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:ftp_publisher:::~~~jenkins~~

CVE-2019-1003055

2019-04-04T12:29:00.600-04:00

2019-10-09T19:44:06.790-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-954 Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:websphere_deployer:::~~~jenkins~~

CVE-2019-1003056

2019-04-04T12:29:00.633-04:00

2019-10-09T19:44:06.897-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-956 Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:bitbucket_approve:::~~~jenkins~~

CVE-2019-1003057

2019-04-04T12:29:00.680-04:00

2019-10-09T19:44:07.023-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-965 Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:ftp_publisher:::~~~jenkins~~

CVE-2019-1003058

2019-04-04T12:29:00.727-04:00

2019-10-09T19:44:07.147-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974 A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:ftp_publisher:::~~~jenkins~~

CVE-2019-1003059

2019-04-04T12:29:00.757-04:00

2019-10-09T19:44:07.273-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974 A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:official_owasp_zap:::~~~jenkins~~

CVE-2019-1003060

2019-04-04T12:29:00.790-04:00

2019-10-09T19:44:07.430-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1041 Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:jenkins-cloudformation-plugin:::~~~jenkins~~

CVE-2019-1003061

2019-04-04T12:29:00.837-04:00

2019-10-09T19:44:07.570-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1042 Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:aws_cloudwatch_logs_publisher:::~~~jenkins~~

CVE-2019-1003062

2019-04-04T12:29:00.867-04:00

2019-10-09T19:44:07.697-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-830 Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:amazon_sns_build_notifier:::~~~jenkins~~

CVE-2019-1003063

2019-04-04T12:29:00.913-04:00

2019-10-09T19:44:08.040-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-832 Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:aws-device-farm:::~~~jenkins~~

CVE-2019-1003064

2019-04-04T12:29:00.947-04:00

2019-10-09T19:44:08.163-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835 Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:cloudshare_docker-machine:::~~~jenkins~~

CVE-2019-1003065

2019-04-04T12:29:00.993-04:00

2019-10-09T19:44:08.303-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-838 Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:bugzilla:::~~~jenkins~~

CVE-2019-1003066

2019-04-04T12:29:01.023-04:00

2019-10-09T19:44:08.447-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-841 Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:trac_publisher:::~~~jenkins~~

CVE-2019-1003067

2019-04-04T12:29:01.057-04:00

2019-10-09T19:44:08.570-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-842 Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:vmware_vrealize_automation:::~~~jenkins~~

CVE-2019-1003068

2019-04-04T12:29:01.087-04:00

2019-10-09T19:44:08.680-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-945 Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:aqua_security_scanner:::~~~jenkins~~

CVE-2019-1003069

2019-04-04T12:29:01.117-04:00

2019-10-09T19:44:08.790-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-949 Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:veracode-scanner:::~~~jenkins~~

CVE-2019-1003070

2019-04-04T12:29:01.147-04:00

2019-10-09T19:44:08.913-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-952 Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:octopusdeploy:::~~~jenkins~~

CVE-2019-1003071

2019-04-04T12:29:01.197-04:00

2019-10-09T19:44:09.023-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-957 Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:wildfly_deployer:::~~~jenkins~~

CVE-2019-1003072

2019-04-04T12:29:01.210-04:00

2019-10-09T19:44:09.147-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-961 Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:vs_team_services_continuous_deployment:::~~~jenkins~~

CVE-2019-1003073

2019-04-04T12:29:01.257-04:00

2019-10-09T19:44:09.273-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962 Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:hyper.sh_commons:-::~~~jenkins~~

CVE-2019-1003074

2019-04-04T12:29:01.290-04:00

2019-10-09T19:44:09.413-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-964 Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:audit_to_database:-::~~~jenkins~~

CVE-2019-1003075

2019-04-04T12:29:01.320-04:00

2019-10-09T19:44:09.540-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-966 Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:audit_to_database:::~~~jenkins~~

CVE-2019-1003076

2019-04-04T12:29:01.350-04:00

2019-10-09T19:44:09.663-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-977 A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:audit_to_database:::~~~jenkins~~

CVE-2019-1003077

2019-04-04T12:29:01.397-04:00

2019-10-09T19:44:09.807-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-977 A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:vmware_lab_manager_slaves:::~~~jenkins~~

CVE-2019-1003078

2019-04-04T12:29:01.430-04:00

2019-10-09T19:44:09.913-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-979 A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:vmware_lab_manager_slaves:::~~~jenkins~~

CVE-2019-1003079

2019-04-04T12:29:01.460-04:00

2019-10-09T19:44:10.040-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-979 A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:openshift_deployer:1.2.0::~~~jenkins~~

CVE-2019-1003080

2019-04-04T12:29:01.493-04:00

2019-10-09T19:44:10.163-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-981 A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:openshift_deployer:::~~~jenkins~~

CVE-2019-1003081

2019-04-04T12:29:01.523-04:00

2019-10-09T19:44:10.290-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-981 A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:gearman:::~~~jenkins~~

CVE-2019-1003082

2019-04-04T12:29:01.570-04:00

2019-10-09T19:44:10.430-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-991 A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:gearman:::~~~jenkins~~

CVE-2019-1003083

2019-04-04T12:29:01.600-04:00

2019-10-09T19:44:10.557-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-991 A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:zephyr_enterprise_test_management:::~~~jenkins~~

CVE-2019-1003084

2019-04-04T12:29:01.647-04:00

2019-10-09T19:44:10.680-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-993 A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:zephyr_enterprise_test_management:::~~~jenkins~~

CVE-2019-1003085

2019-04-04T12:29:01.680-04:00

2019-10-09T19:44:10.807-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-993 A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:chef_sinatra:::~~~jenkins~~

CVE-2019-1003086

2019-04-04T12:29:01.710-04:00

2019-10-09T19:44:10.930-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1037 A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:chef_sinatra:::~~~jenkins~~

CVE-2019-1003087

2019-04-04T12:29:01.757-04:00

2019-10-09T19:44:11.040-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1037 A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:fabric_beta_publisher:::~~~jenkins~~

CVE-2019-1003088

2019-04-04T12:29:01.790-04:00

2019-10-09T19:44:11.163-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1043 Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:upload_to_pgyer:::~~~jenkins~~

CVE-2019-1003089

2019-04-04T12:29:01.837-04:00

2019-10-09T19:44:11.290-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1044 Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:soasta_cloudtest:::~~~jenkins~~

CVE-2019-1003090

2019-04-04T12:29:01.867-04:00

2019-10-09T19:44:11.430-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1054 A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:soasta_cloudtest:::~~~jenkins~~

CVE-2019-1003091

2019-04-04T12:29:01.897-04:00

2019-10-09T19:44:11.557-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1054 A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:nomad:::~~~jenkins~~

CVE-2019-1003092

2019-04-04T12:29:01.947-04:00

2019-10-09T19:44:11.663-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1058 A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:nomad:::~~~jenkins~~

CVE-2019-1003093

2019-04-04T12:29:01.993-04:00

2019-10-09T19:44:11.790-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1058 A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:open_stf:::~~~jenkins~~

CVE-2019-1003094

2019-04-04T12:29:02.023-04:00

2019-10-09T19:44:11.897-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1059 Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:perfecto_mobile:::~~~jenkins~~

CVE-2019-1003095

2019-04-04T12:29:02.070-04:00

2019-10-09T19:44:12.023-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1061 Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:testfairy:::~~~jenkins~~

CVE-2019-1003096

2019-04-04T12:29:02.147-04:00

2019-10-09T19:44:12.133-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1062 Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

cpe:/a:jenkins:crowd_integration:::~~~jenkins~~

CVE-2019-1003097

2019-04-04T12:29:02.180-04:00

2019-10-09T19:44:12.243-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1069 Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

cpe:/a:jenkins:openid:::~~~jenkins~~

CVE-2019-1003098

2019-04-04T12:29:02.227-04:00

2019-10-09T19:44:12.367-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1084 A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an attacker-specified server.

cpe:/a:jenkins:openid:::~~~jenkins~~

CVE-2019-1003099

2019-04-04T12:29:02.273-04:00

2019-10-09T19:44:12.523-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins BID 107790 MISC https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1084 A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

cpe:/a:evernote:evernote:7.9::~~~mac_os_x~~

CVE-2019-10038

2019-05-31T18:29:00.880-04:00

2019-06-03T11:31:34.957-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-06-03T11:13:37.527-04:00

MISC https://drive.google.com/file/d/1cmWixK1vAh7oZ2y3Y3ZtVeSoTRp8c1Ts/view?usp=sharing MISC https://evernote.com/security/updates MISC https://www.inputzero.io/2019/04/evernote-cve-2019-10038.html Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file.

cpe:/o:dlink:dir-816_firmware:1.11

CVE-2019-10039

2019-03-25T15:29:01.477-04:00

2019-03-27T14:24:45.067-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T13:06:25.717-04:00

MISC https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/edit_web_and_sys_account/README.md The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/setSysAdm to edit the web or system account without authentication.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-1004

2019-07-15T15:15:16.310-04:00

2019-07-16T21:09:36.467-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-07-16T09:43:29.987-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1004 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1056, CVE-2019-1059.

cpe:/o:dlink:dir-816_firmware:1.11

CVE-2019-10040

2019-03-25T15:29:01.507-04:00

2019-03-26T14:35:32.470-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-03-26T13:08:14.500-04:00

MISC https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/remote_cmd_exec_0/README.md The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication.

cpe:/o:dlink:dir-816_firmware:1.11

CVE-2019-10041

2019-03-25T15:29:01.540-04:00

2019-03-27T12:31:05.723-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T12:15:24.023-04:00

MISC https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/edit_sys_account/README.md The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/form2userconfig.cgi to edit the system account without authentication.

cpe:/o:dlink:dir-816_firmware:1.11

CVE-2019-10042

2019-03-25T15:29:01.570-04:00

2019-03-27T12:31:50.257-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-03-26T12:06:09.577-04:00

MISC https://github.com/PAGalaxyLab/VulInfo/blob/master/D-Link/DIR-816/reset_router/README.md The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an API URL /goform/LoadDefaultSettings to reset the router without authentication.

cpe:/a:telegram:telegram cpe:/a:telegram:telegram_desktop:0.5.0 cpe:/a:telegram:telegram_desktop:0.5.1 cpe:/a:telegram:telegram_desktop:0.5.2 cpe:/a:telegram:telegram_desktop:0.5.4 cpe:/a:telegram:telegram_desktop:0.5.6 cpe:/a:telegram:telegram_desktop:0.5.7 cpe:/a:telegram:telegram_desktop:0.5.8 cpe:/a:telegram:telegram_desktop:0.5.9 cpe:/a:telegram:telegram_desktop:0.5.10 cpe:/a:telegram:telegram_desktop:0.5.11 cpe:/a:telegram:telegram_desktop:0.5.12 cpe:/a:telegram:telegram_desktop:0.5.13 cpe:/a:telegram:telegram_desktop:0.5.14 cpe:/a:telegram:telegram_desktop:0.5.15 cpe:/a:telegram:telegram_desktop:0.5.16 cpe:/a:telegram:telegram_desktop:0.5.17 cpe:/a:telegram:telegram_desktop:0.5.18 cpe:/a:telegram:telegram_desktop:0.5.19 cpe:/a:telegram:telegram_desktop:0.5.20 cpe:/a:telegram:telegram_desktop:0.5.21 cpe:/a:telegram:telegram_desktop:0.6.0 cpe:/a:telegram:telegram_desktop:0.6.1 cpe:/a:telegram:telegram_desktop:0.6.2 cpe:/a:telegram:telegram_desktop:0.6.3 cpe:/a:telegram:telegram_desktop:0.6.4 cpe:/a:telegram:telegram_desktop:0.6.5 cpe:/a:telegram:telegram_desktop:0.6.6 cpe:/a:telegram:telegram_desktop:0.6.7 cpe:/a:telegram:telegram_desktop:0.6.8 cpe:/a:telegram:telegram_desktop:0.6.9 cpe:/a:telegram:telegram_desktop:0.6.10 cpe:/a:telegram:telegram_desktop:0.6.11 cpe:/a:telegram:telegram_desktop:0.6.12 cpe:/a:telegram:telegram_desktop:0.6.13 cpe:/a:telegram:telegram_desktop:0.6.14 cpe:/a:telegram:telegram_desktop:0.6.15 cpe:/a:telegram:telegram_desktop:0.6.16 cpe:/a:telegram:telegram_desktop:0.6.17 cpe:/a:telegram:telegram_desktop:0.6.18 cpe:/a:telegram:telegram_desktop:0.6.19 cpe:/a:telegram:telegram_desktop:0.6.20 cpe:/a:telegram:telegram_desktop:0.6.21 cpe:/a:telegram:telegram_desktop:0.7.0 cpe:/a:telegram:telegram_desktop:0.7.1 cpe:/a:telegram:telegram_desktop:0.7.2 cpe:/a:telegram:telegram_desktop:0.7.3 cpe:/a:telegram:telegram_desktop:0.7.4 cpe:/a:telegram:telegram_desktop:0.7.5 cpe:/a:telegram:telegram_desktop:0.7.6 cpe:/a:telegram:telegram_desktop:0.7.7 cpe:/a:telegram:telegram_desktop:0.7.8 cpe:/a:telegram:telegram_desktop:0.7.9 cpe:/a:telegram:telegram_desktop:0.7.10 cpe:/a:telegram:telegram_desktop:0.7.11 cpe:/a:telegram:telegram_desktop:0.7.12 cpe:/a:telegram:telegram_desktop:0.7.13 cpe:/a:telegram:telegram_desktop:0.7.14 cpe:/a:telegram:telegram_desktop:0.7.15 cpe:/a:telegram:telegram_desktop:0.7.16 cpe:/a:telegram:telegram_desktop:0.7.17 cpe:/a:telegram:telegram_desktop:0.7.18 cpe:/a:telegram:telegram_desktop:0.7.19 cpe:/a:telegram:telegram_desktop:0.7.20 cpe:/a:telegram:telegram_desktop:0.7.21 cpe:/a:telegram:telegram_desktop:0.7.22 cpe:/a:telegram:telegram_desktop:0.7.23 cpe:/a:telegram:telegram_desktop:0.7.24 cpe:/a:telegram:telegram_desktop:0.7.25 cpe:/a:telegram:telegram_desktop:0.7.26 cpe:/a:telegram:telegram_desktop:0.8.0 cpe:/a:telegram:telegram_desktop:0.8.1 cpe:/a:telegram:telegram_desktop:0.8.2 cpe:/a:telegram:telegram_desktop:0.8.3 cpe:/a:telegram:telegram_desktop:0.8.4 cpe:/a:telegram:telegram_desktop:0.8.5 cpe:/a:telegram:telegram_desktop:0.8.6 cpe:/a:telegram:telegram_desktop:0.8.7 cpe:/a:telegram:telegram_desktop:0.8.8 cpe:/a:telegram:telegram_desktop:0.8.9 cpe:/a:telegram:telegram_desktop:0.8.10 cpe:/a:telegram:telegram_desktop:0.8.11 cpe:/a:telegram:telegram_desktop:0.8.12 cpe:/a:telegram:telegram_desktop:0.8.13 cpe:/a:telegram:telegram_desktop:0.8.14 cpe:/a:telegram:telegram_desktop:0.8.15 cpe:/a:telegram:telegram_desktop:0.8.16 cpe:/a:telegram:telegram_desktop:0.8.17 cpe:/a:telegram:telegram_desktop:0.8.18 cpe:/a:telegram:telegram_desktop:0.8.19 cpe:/a:telegram:telegram_desktop:0.8.20 cpe:/a:telegram:telegram_desktop:0.8.21 cpe:/a:telegram:telegram_desktop:0.8.22 cpe:/a:telegram:telegram_desktop:0.8.23 cpe:/a:telegram:telegram_desktop:0.8.24 cpe:/a:telegram:telegram_desktop:0.8.25 cpe:/a:telegram:telegram_desktop:0.8.26 cpe:/a:telegram:telegram_desktop:0.8.27 cpe:/a:telegram:telegram_desktop:0.8.28 cpe:/a:telegram:telegram_desktop:0.8.29 cpe:/a:telegram:telegram_desktop:0.8.30 cpe:/a:telegram:telegram_desktop:0.8.31 cpe:/a:telegram:telegram_desktop:0.8.32 cpe:/a:telegram:telegram_desktop:0.8.33 cpe:/a:telegram:telegram_desktop:0.8.34 cpe:/a:telegram:telegram_desktop:0.8.35 cpe:/a:telegram:telegram_desktop:0.8.36 cpe:/a:telegram:telegram_desktop:0.8.37 cpe:/a:telegram:telegram_desktop:0.8.38 cpe:/a:telegram:telegram_desktop:0.8.39 cpe:/a:telegram:telegram_desktop:0.8.40 cpe:/a:telegram:telegram_desktop:0.8.41 cpe:/a:telegram:telegram_desktop:0.8.42 cpe:/a:telegram:telegram_desktop:0.8.43 cpe:/a:telegram:telegram_desktop:0.8.44 cpe:/a:telegram:telegram_desktop:0.8.45 cpe:/a:telegram:telegram_desktop:0.8.46 cpe:/a:telegram:telegram_desktop:0.8.47 cpe:/a:telegram:telegram_desktop:0.8.48 cpe:/a:telegram:telegram_desktop:0.8.49 cpe:/a:telegram:telegram_desktop:0.8.50 cpe:/a:telegram:telegram_desktop:0.8.51 cpe:/a:telegram:telegram_desktop:0.8.52 cpe:/a:telegram:telegram_desktop:0.8.53 cpe:/a:telegram:telegram_desktop:0.8.54 cpe:/a:telegram:telegram_desktop:0.8.55 cpe:/a:telegram:telegram_desktop:0.8.56 cpe:/a:telegram:telegram_desktop:0.8.57 cpe:/a:telegram:telegram_desktop:0.8.58 cpe:/a:telegram:telegram_desktop:0.8.59 cpe:/a:telegram:telegram_desktop:0.9.0 cpe:/a:telegram:telegram_desktop:0.9.1 cpe:/a:telegram:telegram_desktop:0.9.2 cpe:/a:telegram:telegram_desktop:0.9.3 cpe:/a:telegram:telegram_desktop:0.9.4 cpe:/a:telegram:telegram_desktop:0.9.5 cpe:/a:telegram:telegram_desktop:0.9.6 cpe:/a:telegram:telegram_desktop:0.9.7 cpe:/a:telegram:telegram_desktop:0.9.8 cpe:/a:telegram:telegram_desktop:0.9.9 cpe:/a:telegram:telegram_desktop:0.9.10 cpe:/a:telegram:telegram_desktop:0.9.11 cpe:/a:telegram:telegram_desktop:0.9.12 cpe:/a:telegram:telegram_desktop:0.9.13 cpe:/a:telegram:telegram_desktop:0.9.14 cpe:/a:telegram:telegram_desktop:0.9.15 cpe:/a:telegram:telegram_desktop:0.9.16 cpe:/a:telegram:telegram_desktop:0.9.17 cpe:/a:telegram:telegram_desktop:0.9.18 cpe:/a:telegram:telegram_desktop:0.9.19 cpe:/a:telegram:telegram_desktop:0.9.20 cpe:/a:telegram:telegram_desktop:0.9.21 cpe:/a:telegram:telegram_desktop:0.9.22 cpe:/a:telegram:telegram_desktop:0.9.23 cpe:/a:telegram:telegram_desktop:0.9.24 cpe:/a:telegram:telegram_desktop:0.9.25 cpe:/a:telegram:telegram_desktop:0.9.26 cpe:/a:telegram:telegram_desktop:0.9.27 cpe:/a:telegram:telegram_desktop:0.9.28 cpe:/a:telegram:telegram_desktop:0.9.29 cpe:/a:telegram:telegram_desktop:0.9.30 cpe:/a:telegram:telegram_desktop:0.9.31 cpe:/a:telegram:telegram_desktop:0.9.32 cpe:/a:telegram:telegram_desktop:0.9.33 cpe:/a:telegram:telegram_desktop:0.9.34 cpe:/a:telegram:telegram_desktop:0.9.35 cpe:/a:telegram:telegram_desktop:0.9.36 cpe:/a:telegram:telegram_desktop:0.9.37 cpe:/a:telegram:telegram_desktop:0.9.38 cpe:/a:telegram:telegram_desktop:0.9.39 cpe:/a:telegram:telegram_desktop:0.9.40 cpe:/a:telegram:telegram_desktop:0.9.41 cpe:/a:telegram:telegram_desktop:0.9.42 cpe:/a:telegram:telegram_desktop:0.9.43 cpe:/a:telegram:telegram_desktop:0.9.44 cpe:/a:telegram:telegram_desktop:0.9.45 cpe:/a:telegram:telegram_desktop:0.9.46 cpe:/a:telegram:telegram_desktop:0.9.47 cpe:/a:telegram:telegram_desktop:0.9.48 cpe:/a:telegram:telegram_desktop:0.9.49 cpe:/a:telegram:telegram_desktop:0.9.50 cpe:/a:telegram:telegram_desktop:0.9.51 cpe:/a:telegram:telegram_desktop:0.9.52 cpe:/a:telegram:telegram_desktop:0.9.53 cpe:/a:telegram:telegram_desktop:0.9.54 cpe:/a:telegram:telegram_desktop:0.9.55 cpe:/a:telegram:telegram_desktop:0.9.56 cpe:/a:telegram:telegram_desktop:0.9.57 cpe:/a:telegram:telegram_desktop:0.9.58 cpe:/a:telegram:telegram_desktop:0.9.59 cpe:/a:telegram:telegram_desktop:0.9.60 cpe:/a:telegram:telegram_desktop:0.10.0 cpe:/a:telegram:telegram_desktop:0.10.1 cpe:/a:telegram:telegram_desktop:0.10.2 cpe:/a:telegram:telegram_desktop:0.10.3 cpe:/a:telegram:telegram_desktop:0.10.4 cpe:/a:telegram:telegram_desktop:0.10.5 cpe:/a:telegram:telegram_desktop:0.10.6 cpe:/a:telegram:telegram_desktop:0.10.7 cpe:/a:telegram:telegram_desktop:0.10.8 cpe:/a:telegram:telegram_desktop:0.10.9 cpe:/a:telegram:telegram_desktop:0.10.10 cpe:/a:telegram:telegram_desktop:0.10.11 cpe:/a:telegram:telegram_desktop:0.10.12 cpe:/a:telegram:telegram_desktop:0.10.13 cpe:/a:telegram:telegram_desktop:0.10.14 cpe:/a:telegram:telegram_desktop:0.10.15 cpe:/a:telegram:telegram_desktop:0.10.16 cpe:/a:telegram:telegram_desktop:0.10.17 cpe:/a:telegram:telegram_desktop:0.10.18 cpe:/a:telegram:telegram_desktop:0.10.19 cpe:/a:telegram:telegram_desktop:0.10.20 cpe:/a:telegram:telegram_desktop:0.10.21 cpe:/a:telegram:telegram_desktop:0.10.22 cpe:/a:telegram:telegram_desktop:0.10.23 cpe:/a:telegram:telegram_desktop:0.10.24 cpe:/a:telegram:telegram_desktop:0.10.25 cpe:/a:telegram:telegram_desktop:0.10.26 cpe:/a:telegram:telegram_desktop:0.10.27 cpe:/a:telegram:telegram_desktop:1.0.0 cpe:/a:telegram:telegram_desktop:1.0.1 cpe:/a:telegram:telegram_desktop:1.0.2 cpe:/a:telegram:telegram_desktop:1.0.3 cpe:/a:telegram:telegram_desktop:1.0.4 cpe:/a:telegram:telegram_desktop:1.0.5 cpe:/a:telegram:telegram_desktop:1.0.6 cpe:/a:telegram:telegram_desktop:1.0.7 cpe:/a:telegram:telegram_desktop:1.0.8 cpe:/a:telegram:telegram_desktop:1.0.9 cpe:/a:telegram:telegram_desktop:1.0.10 cpe:/a:telegram:telegram_desktop:1.0.11 cpe:/a:telegram:telegram_desktop:1.0.12 cpe:/a:telegram:telegram_desktop:1.0.13 cpe:/a:telegram:telegram_desktop:1.0.14 cpe:/a:telegram:telegram_desktop:1.0.15 cpe:/a:telegram:telegram_desktop:1.0.16 cpe:/a:telegram:telegram_desktop:1.0.17 cpe:/a:telegram:telegram_desktop:1.0.18 cpe:/a:telegram:telegram_desktop:1.0.19 cpe:/a:telegram:telegram_desktop:1.0.20 cpe:/a:telegram:telegram_desktop:1.0.21 cpe:/a:telegram:telegram_desktop:1.0.22 cpe:/a:telegram:telegram_desktop:1.0.23 cpe:/a:telegram:telegram_desktop:1.0.24 cpe:/a:telegram:telegram_desktop:1.0.25 cpe:/a:telegram:telegram_desktop:1.0.26 cpe:/a:telegram:telegram_desktop:1.0.27 cpe:/a:telegram:telegram_desktop:1.0.28 cpe:/a:telegram:telegram_desktop:1.0.29 cpe:/a:telegram:telegram_desktop:1.0.30 cpe:/a:telegram:telegram_desktop:1.0.31 cpe:/a:telegram:telegram_desktop:1.0.32 cpe:/a:telegram:telegram_desktop:1.0.33 cpe:/a:telegram:telegram_desktop:1.0.34 cpe:/a:telegram:telegram_desktop:1.0.35 cpe:/a:telegram:telegram_desktop:1.0.36 cpe:/a:telegram:telegram_desktop:1.0.37 cpe:/a:telegram:telegram_desktop:1.0.38 cpe:/a:telegram:telegram_desktop:1.1.0 cpe:/a:telegram:telegram_desktop:1.1.1 cpe:/a:telegram:telegram_desktop:1.1.2 cpe:/a:telegram:telegram_desktop:1.1.3 cpe:/a:telegram:telegram_desktop:1.1.4 cpe:/a:telegram:telegram_desktop:1.1.5 cpe:/a:telegram:telegram_desktop:1.1.6 cpe:/a:telegram:telegram_desktop:1.1.7 cpe:/a:telegram:telegram_desktop:1.1.8 cpe:/a:telegram:telegram_desktop:1.1.9 cpe:/a:telegram:telegram_desktop:1.1.10 cpe:/a:telegram:telegram_desktop:1.1.11 cpe:/a:telegram:telegram_desktop:1.1.12 cpe:/a:telegram:telegram_desktop:1.1.13 cpe:/a:telegram:telegram_desktop:1.1.14 cpe:/a:telegram:telegram_desktop:1.1.15 cpe:/a:telegram:telegram_desktop:1.1.16 cpe:/a:telegram:telegram_desktop:1.1.17 cpe:/a:telegram:telegram_desktop:1.1.18 cpe:/a:telegram:telegram_desktop:1.1.19 cpe:/a:telegram:telegram_desktop:1.1.20 cpe:/a:telegram:telegram_desktop:1.1.21 cpe:/a:telegram:telegram_desktop:1.1.22 cpe:/a:telegram:telegram_desktop:1.1.23 cpe:/a:telegram:telegram_desktop:1.1.24 cpe:/a:telegram:telegram_desktop:1.1.25 cpe:/a:telegram:telegram_desktop:1.1.26 cpe:/a:telegram:telegram_desktop:1.1.27 cpe:/a:telegram:telegram_desktop:1.1.28 cpe:/a:telegram:telegram_desktop:1.1.29 cpe:/a:telegram:telegram_desktop:1.2.0 cpe:/a:telegram:telegram_desktop:1.2.1 cpe:/a:telegram:telegram_desktop:1.2.2 cpe:/a:telegram:telegram_desktop:1.2.3 cpe:/a:telegram:telegram_desktop:1.2.4 cpe:/a:telegram:telegram_desktop:1.2.5 cpe:/a:telegram:telegram_desktop:1.2.6 cpe:/a:telegram:telegram_desktop:1.2.7 cpe:/a:telegram:telegram_desktop:1.2.8 cpe:/a:telegram:telegram_desktop:1.2.9 cpe:/a:telegram:telegram_desktop:1.2.10 cpe:/a:telegram:telegram_desktop:1.2.11 cpe:/a:telegram:telegram_desktop:1.2.12 cpe:/a:telegram:telegram_desktop:1.2.13 cpe:/a:telegram:telegram_desktop:1.2.14 cpe:/a:telegram:telegram_desktop:1.2.15 cpe:/a:telegram:telegram_desktop:1.2.16 cpe:/a:telegram:telegram_desktop:1.2.17 cpe:/a:telegram:telegram_desktop:1.2.18 cpe:/a:telegram:telegram_desktop:1.2.19 cpe:/a:telegram:telegram_desktop:1.2.20 cpe:/a:telegram:telegram_desktop:1.2.21 cpe:/a:telegram:telegram_desktop:1.2.22 cpe:/a:telegram:telegram_desktop:1.2.23 cpe:/a:telegram:telegram_desktop:1.2.24 cpe:/a:telegram:telegram_desktop:1.2.25 cpe:/a:telegram:telegram_desktop:1.3.0 cpe:/a:telegram:telegram_desktop:1.3.1 cpe:/a:telegram:telegram_desktop:1.3.2 cpe:/a:telegram:telegram_desktop:1.3.3 cpe:/a:telegram:telegram_desktop:1.3.4 cpe:/a:telegram:telegram_desktop:1.3.5 cpe:/a:telegram:telegram_desktop:1.3.6 cpe:/a:telegram:telegram_desktop:1.3.7 cpe:/a:telegram:telegram_desktop:1.3.8 cpe:/a:telegram:telegram_desktop:1.3.9 cpe:/a:telegram:telegram_desktop:1.3.10 cpe:/a:telegram:telegram_desktop:1.3.11 cpe:/a:telegram:telegram_desktop:1.3.12 cpe:/a:telegram:telegram_desktop:1.3.13 cpe:/a:telegram:telegram_desktop:1.3.15 cpe:/a:telegram:telegram_desktop:1.3.16:- cpe:/a:telegram:telegram_desktop:1.3.16:alpha cpe:/a:telegram:telegram_desktop:1.3.17 cpe:/a:telegram:telegram_desktop:1.4.0 cpe:/a:telegram:telegram_desktop:1.4.1 cpe:/a:telegram:telegram_desktop:1.4.2 cpe:/a:telegram:telegram_desktop:1.4.3 cpe:/a:telegram:telegram_desktop:1.4.4 cpe:/a:telegram:telegram_desktop:1.4.5 cpe:/a:telegram:telegram_desktop:1.4.6 cpe:/a:telegram:telegram_desktop:1.4.7 cpe:/a:telegram:telegram_desktop:1.4.8 cpe:/a:telegram:telegram_desktop:1.5.0 cpe:/a:telegram:telegram_desktop:1.5.1 cpe:/a:telegram:telegram_desktop:1.5.2 cpe:/a:telegram:telegram_desktop:1.5.3 cpe:/a:telegram:telegram_desktop:1.5.4 cpe:/a:telegram:telegram_desktop:1.5.5 cpe:/a:telegram:telegram_desktop:1.5.6 cpe:/a:telegram:telegram_desktop:1.5.7 cpe:/a:telegram:telegram_desktop:1.5.8 cpe:/a:telegram:telegram_desktop:1.5.9 cpe:/a:telegram:telegram_desktop:1.5.10 cpe:/a:telegram:telegram_desktop:1.5.11

CVE-2019-10044

2019-03-25T16:29:00.863-04:00

2019-04-07T21:50:16.170-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-04-03T10:34:35.057-04:00

BID 107610 MISC https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

cpe:/a:pydio:pydio:8.2.2

CVE-2019-10045

2019-05-31T18:29:00.957-04:00

2019-06-03T09:14:13.193-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-03T08:45:19.440-04:00

MISC https://www.secureauth.com/labs/advisories The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her (if the session is still active).

cpe:/a:pydio:pydio:8.2.2

CVE-2019-10046

2019-05-31T18:29:01.020-04:00

2019-06-03T09:37:09.257-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-03T08:55:41.937-04:00

MISC https://www.secureauth.com/labs/advisories An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information.

cpe:/a:pydio:pydio:8.2.2

CVE-2019-10047

2019-05-31T18:29:01.050-04:00

2019-06-03T10:06:14.367-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-03T09:55:42.047-04:00

MISC https://www.secureauth.com/labs/advisories A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application, and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser, then the included JavaScript code is executed under the context of the victim user session.

cpe:/a:pydio:pydio:8.2.2

CVE-2019-10048

2019-05-31T18:29:01.097-04:00

2019-06-03T10:04:28.333-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-06-03T09:46:22.457-04:00

MISC https://www.secureauth.com/labs/advisories The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying operating system, with the privileges of the local user running the web server. The attacker must be authenticated into the application with an administrator user account in order to be able to edit the affected plugin configuration.

cpe:/a:pydio:pydio:8.2.2

CVE-2019-10049

2019-05-31T18:29:01.130-04:00

2019-06-03T11:30:37.293-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-03T09:57:40.970-04:00

MISC https://www.secureauth.com/labs/advisories It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared through the application, that in turn opens a shared file that contains JavaScript code (that is executed in the context of the victim user to obtain sensitive information such as session identifiers and perform actions on behalf of him/her).

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2019-1005

2019-06-12T10:29:02.557-04:00

2019-06-13T11:18:13.900-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2019-06-13T09:13:24.440-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1005 A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0920, CVE-2019-0988, CVE-2019-1055, CVE-2019-1080.

cpe:/a:suricata-ids:suricata:4.0.0 cpe:/a:suricata-ids:suricata:4.0.0:b1 cpe:/a:suricata-ids:suricata:4.0.0:rc1 cpe:/a:suricata-ids:suricata:4.0.0:rc2 cpe:/a:suricata-ids:suricata:4.0.1 cpe:/a:suricata-ids:suricata:4.0.2 cpe:/a:suricata-ids:suricata:4.0.3 cpe:/a:suricata-ids:suricata:4.0.4 cpe:/a:suricata-ids:suricata:4.1.0:b1

CVE-2019-10050

2019-05-13T13:29:02.097-04:00

2019-05-13T23:27:30.863-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-13T14:25:50.087-04:00

MISC https://lists.openinfosecfoundation.org/pipermail/oisf-announce/ MISC https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.

cpe:/a:suricata-ids:suricata:4.1.3 cpe:/a:suricata-ids:suricata:4.1.4

CVE-2019-10051

2019-08-28T16:15:10.327-04:00

2019-09-05T11:35:22.897-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-29T13:54:31.097-04:00

MISC https://github.com/OISF/suricata/pull/3734 MISC https://redmine.openinfosecfoundation.org/issues/2896 CONFIRM https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, then the program enters an smb/files.rs error condition and crashes.

cpe:/a:suricata-ids:suricata:4.1.3

CVE-2019-10052

2019-08-28T16:15:10.390-04:00

2019-09-04T15:59:52.277-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-29T13:36:47.893-04:00

MISC https://redmine.openinfosecfoundation.org/issues/2902 MISC https://redmine.openinfosecfoundation.org/issues/2947 CONFIRM https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP packet. At this point, the Rust environment runs into a panic in parse_clientid_option in the dhcp/parser.rs file.

cpe:/a:suricata-ids:suricata:4.1.0:b1

CVE-2019-10053

2019-05-13T17:29:01.560-04:00

2019-05-14T12:34:22.970-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-14T08:59:25.727-04:00

MISC https://lists.openinfosecfoundation.org/pipermail/oisf-announce/ MISC https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

cpe:/a:suricata-ids:suricata:4.1.3

CVE-2019-10054

2019-08-28T17:15:10.460-04:00

2019-09-04T15:21:48.960-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-29T13:19:52.597-04:00

MISC https://redmine.openinfosecfoundation.org/issues/2943 CONFIRM https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.

cpe:/a:suricata-ids:suricata:4.1.4

CVE-2019-10055

2019-08-28T17:15:10.553-04:00

2019-09-05T11:06:58.820-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-08-29T13:31:50.067-04:00

MISC https://redmine.openinfosecfoundation.org/issues/2949 CONFIRM https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.

cpe:/a:suricata-ids:suricata:4.1.3 cpe:/a:suricata-ids:suricata:4.1.4

CVE-2019-10056

2019-08-28T17:15:10.630-04:00

2019-09-05T14:07:39.627-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-08-29T13:09:55.820-04:00

MISC https://redmine.openinfosecfoundation.org/issues/2946 CONFIRM https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

cpe:/o:lexmark:cs31x_firmware:lw71.vyl.p228 cpe:/o:lexmark:cs41x_firmware:lw71.vy2.p228 cpe:/o:lexmark:cx310_firmware:lw71.gm2.p228 cpe:/o:lexmark:m1140_firmware:lw71.prl.p228 cpe:/o:lexmark:m1145_firmware:lw71.pr2.p228 cpe:/o:lexmark:m3150dn_firmware:lw71.pr2.p228 cpe:/o:lexmark:m5163dn_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms310_firmware:lw71.prl.p228 cpe:/o:lexmark:ms312_firmware:lw71.prl.p228 cpe:/o:lexmark:ms315_firmware:lw71.tl2.p228 cpe:/o:lexmark:ms317_firmware:lw71.prl.p228 cpe:/o:lexmark:ms410_firmware:lw71.prl.p228 cpe:/o:lexmark:ms415_firmware:lw71.tl2.p228 cpe:/o:lexmark:ms417_firmware:lw71.tl2.p228 cpe:/o:lexmark:ms51x_firmware:lw71.pr2.p228 cpe:/o:lexmark:ms610dn_firmware:lw71.pr2.p228 cpe:/o:lexmark:ms617_firmware:lw71.pr2.p228 cpe:/o:lexmark:ms71x_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms810_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms811_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms812_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms817_firmware:lw71.dn2.p228 cpe:/o:lexmark:ms818_firmware:lw71.dn2.p228 cpe:/o:lexmark:mx31x_firmware:lw71.sb2.p228 cpe:/o:lexmark:xm1135_firmware:lw71.sb2.p228

CVE-2019-10057

2019-08-28T18:15:11.640-04:00

2019-08-29T13:14:54.520-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-29T11:18:06.770-04:00

CONFIRM http://support.lexmark.com/index?page=content&id=TE921&locale=EN&userlocale=EN_US Various Lexmark products have CSRF.

cpe:/o:lexmark:6500e_firmware:lhs60.jr.p705 cpe:/o:lexmark:c734_firmware:lr.sk.p815 cpe:/o:lexmark:c736_firmware:lr.ske.p815 cpe:/o:lexmark:c746_firmware:lhs60.cm2.p705 cpe:/o:lexmark:c748_firmware:lhs60.cm4.p705 cpe:/o:lexmark:c792_firmware:lhs60.hc.p705 cpe:/o:lexmark:c925_firmware:lhs60.hv.p705 cpe:/o:lexmark:c950_firmware:lhs60.tp.p705 cpe:/o:lexmark:cs31x_firmware:lw71.vyl.p229 cpe:/o:lexmark:cs41x_firmware:lw71.vy2.p229 cpe:/o:lexmark:cs51x_firmware:lw71.vy4.p229 cpe:/o:lexmark:cs748_firmware:lhs60.cm4.p705 cpe:/o:lexmark:cs796_firmware:lhs60.hc.p705 cpe:/o:lexmark:cx310_firmware:lw71.gm2.p229 cpe:/o:lexmark:e46x_firmware:lr.lbh.p815 cpe:/o:lexmark:m1140_firmware:lw71.prl.p229 cpe:/o:lexmark:m1145_firmware:lw71.pr2.p229 cpe:/o:lexmark:m3150_firmware:lw71.pr4.p229 cpe:/o:lexmark:m3150dn_firmware:lw71.pr2.p229 cpe:/o:lexmark:m5155_firmware:lw71.dn4.p229 cpe:/o:lexmark:m5163_firmware:lw71.dn4.p229 cpe:/o:lexmark:m5163dn_firmware:lw71.dn2.p229 cpe:/o:lexmark:m5170_firmware:lw71.dn7.p229 cpe:/o:lexmark:ms310_firmware:lw71.prl.p229 cpe:/o:lexmark:ms312_firmware:lw71.prl.p229 cpe:/o:lexmark:ms315_firmware:lw71.tl2.p229 cpe:/o:lexmark:ms317_firmware:lw71.prl.p229 cpe:/o:lexmark:ms410_firmware:lw71.prl.p229 cpe:/o:lexmark:ms415_firmware:lw71.tl2.p229 cpe:/o:lexmark:ms417_firmware:lw71.tl2.p229 cpe:/o:lexmark:ms51x_firmware:lw71.pr2.p229 cpe:/o:lexmark:ms610de_firmware:lw71.pr4.p229 cpe:/o:lexmark:ms610dn_firmware:lw71.pr2.p229 cpe:/o:lexmark:ms617_firmware:lw71.pr2.p229 cpe:/o:lexmark:ms71x_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms810_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms810de_firmware:lw71.dn4.p229 cpe:/o:lexmark:ms811_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms812_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms812de_firmware:lw71.dn7.p229 cpe:/o:lexmark:ms817_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms818_firmware:lw71.dn2.p229 cpe:/o:lexmark:ms91x_firmware:lw71.sa.p229 cpe:/o:lexmark:mx31x_firmware:lw71.sb2.p229 cpe:/o:lexmark:mx410_firmware:lw71.sb4.p229 cpe:/o:lexmark:mx510_firmware:lw71.sb4.p229 cpe:/o:lexmark:mx511_firmware:lw71.sb4.p229 cpe:/o:lexmark:mx610_firmware:lw71.sb7.p229 cpe:/o:lexmark:mx611_firmware:lw71.sb7.p229 cpe:/o:lexmark:mx6500e_firmware:lw71.jd.p229 cpe:/o:lexmark:mx71x_firmware:lw71.tu.p229 cpe:/o:lexmark:mx81x_firmware:lw71.tu.p229 cpe:/o:lexmark:mx91x_firmware:lw71.mg.p229 cpe:/o:lexmark:t65x_firmware:lr.jp.p815 cpe:/o:lexmark:w850_firmware:lp.jb.p815 cpe:/o:lexmark:x46x_firmware:lr.bs.p815 cpe:/o:lexmark:x548_firmware:lhs60.vk.p705 cpe:/o:lexmark:x65x_firmware:lr.mn.p815 cpe:/o:lexmark:x73x_firmware:lr.fl.p815 cpe:/o:lexmark:x74x_firmware:lhs60.ny.p705 cpe:/o:lexmark:x792_firmware:lhs60.mr.p705 cpe:/o:lexmark:x86x_firmware:lp.sp.p815 cpe:/o:lexmark:x925_firmware:lhs60.hk.p705 cpe:/o:lexmark:x95x_firmware:lhs60.tq.p705 cpe:/o:lexmark:xm1135_firmware:lw71.sb2.p229 cpe:/o:lexmark:xm3150_firmware:lw71.sb7.p229 cpe:/o:lexmark:xm51xx_firmware:lw71.tu.p229 cpe:/o:lexmark:xm71xx_firmware:lw71.tu.p229 cpe:/o:lexmark:xm91x_firmware:lw71.mg.p229 cpe:/o:lexmark:xs548_firmware:lhs60.vk.p705 cpe:/o:lexmark:xs748_firmware:lhs60.ny.p705 cpe:/o:lexmark:xs79x_firmware:lhs60.mr.p705 cpe:/o:lexmark:xs925_firmware:lhs60.hk.p705 cpe:/o:lexmark:xs95x_firmware:lhs60.tq.p705

CVE-2019-10058

2019-08-28T12:15:10.843-04:00

2019-08-29T11:41:49.193-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-29T08:33:09.347-04:00

CONFIRM http://support.lexmark.com/index?page=content&id=TE922&locale=EN&userlocale=EN_US Various Lexmark products have Incorrect Access Control.

cpe:/o:lexmark:6500e_firmware:lhs60.jr.p705 cpe:/o:lexmark:c734_firmware:lr.sk.p815 cpe:/o:lexmark:c736_firmware:lr.ske.p815 cpe:/o:lexmark:c746_firmware:lhs60.cm2.p705 cpe:/o:lexmark:c748_firmware:lhs60.cm4.p705 cpe:/o:lexmark:c792_firmware:lhs60.hc.p705 cpe:/o:lexmark:c925_firmware:lhs60.hv.p705 cpe:/o:lexmark:c950_firmware:lhs60.tp.p705 cpe:/o:lexmark:cs31x_firmware:lw71.vyl.p233 cpe:/o:lexmark:cs41x_firmware:lw71.vy2.p233 cpe:/o:lexmark:cs748_firmware:lhs60.cm4.p705 cpe:/o:lexmark:cs796_firmware:lhs60.hc.p705 cpe:/o:lexmark:cx310_firmware:lw71.gm2.p233 cpe:/o:lexmark:e46x_firmware:lr.lbh.p815 cpe:/o:lexmark:m1140_firmware:lw71.prl.p233 cpe:/o:lexmark:m1145_firmware:lw71.pr2.p233 cpe:/o:lexmark:m3150dn_firmware:lw71.pr2.p233 cpe:/o:lexmark:m5155_firmware:lw71.dn4.p233 cpe:/o:lexmark:m5163_firmware:lw71.dn4.p233 cpe:/o:lexmark:m5163dn_firmware:lw71.dn2.p233 cpe:/o:lexmark:m5170_firmware:lw71.dn7.p233 cpe:/o:lexmark:ms310_firmware:lw71.prl.p233 cpe:/o:lexmark:ms312_firmware:lw71.prl.p233 cpe:/o:lexmark:ms315_firmware:lw71.tl2.p233 cpe:/o:lexmark:ms317_firmware:lw71.prl.p233 cpe:/o:lexmark:ms410_firmware:lw71.prl.p233 cpe:/o:lexmark:ms415_firmware:lw71.tl2.p233 cpe:/o:lexmark:ms417_firmware:lw71.tl2.p233 cpe:/o:lexmark:ms51x_firmware:lw71.pr2.p233 cpe:/o:lexmark:ms610dn_firmware:lw71.pr2.p233 cpe:/o:lexmark:ms617_firmware:lw71.pr2.p233 cpe:/o:lexmark:ms71x_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms810_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms810de_firmware:lw71.dn4.p233 cpe:/o:lexmark:ms811_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms812_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms812de_firmware:lw71.dn7.p233 cpe:/o:lexmark:ms817_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms818_firmware:lw71.dn2.p233 cpe:/o:lexmark:ms91x_firmware:lw71.sa.p233 cpe:/o:lexmark:mx31x_firmware:lw71.sb2.p233 cpe:/o:lexmark:mx410_firmware:lw71.sb4.p233 cpe:/o:lexmark:mx510_firmware:lw71.sb4.p233 cpe:/o:lexmark:mx511_firmware:lw71.sb4.p233 cpe:/o:lexmark:mx610_firmware:lw71.sb7.p233 cpe:/o:lexmark:mx611_firmware:lw71.sb7.p233 cpe:/o:lexmark:mx6500e_firmware:lw71.jd.p233 cpe:/o:lexmark:mx71x_firmware:lw71.tu.p233 cpe:/o:lexmark:mx81x_firmware:lw71.tu.p233 cpe:/o:lexmark:mx91x_firmware:lw71.mg.p233 cpe:/o:lexmark:t65x_firmware:lr.jp.p815 cpe:/o:lexmark:w850_firmware:lp.jb.p815 cpe:/o:lexmark:x46x_firmware:lr.bs.p815 cpe:/o:lexmark:x548_firmware:lhs60.vk.p705 cpe:/o:lexmark:x65x_firmware:lr.mn.p815 cpe:/o:lexmark:x73x_firmware:lr.fl.p815 cpe:/o:lexmark:x74x_firmware:lhs60.ny.p705 cpe:/o:lexmark:x792_firmware:lhs60.mr.p705 cpe:/o:lexmark:x86x_firmware:lp.sp.p815 cpe:/o:lexmark:x925_firmware:lhs60.hk.p705 cpe:/o:lexmark:x95x_firmware:lhs60.tq.p705 cpe:/o:lexmark:xm1135_firmware:lw71.sb2.p233 cpe:/o:lexmark:xm3150_firmware:lw71.sb7.p233 cpe:/o:lexmark:xm51xx_firmware:lw71.tu.p233 cpe:/o:lexmark:xm71xx_firmware:lw71.tu.p233 cpe:/o:lexmark:xm91x_firmware:lw71.mg.p233 cpe:/o:lexmark:xs548_firmware:lhs60.vk.p705 cpe:/o:lexmark:xs748_firmware:lhs60.ny.p705 cpe:/o:lexmark:xs79x_firmware:lhs60.mr.p705 cpe:/o:lexmark:xs925_firmware:lhs60.hk.p705 cpe:/o:lexmark:xs95x_firmware:lhs60.tq.p705

CVE-2019-10059

2019-08-28T18:15:11.703-04:00

2019-09-03T12:03:11.103-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-29T14:33:24.347-04:00

CONFIRM http://support.lexmark.com/index?page=content&id=TE923&locale=EN&userlocale=EN_US The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1 cpe:/a:microsoft:.net_framework:4.6.2 cpe:/a:microsoft:.net_framework:4.7 cpe:/a:microsoft:.net_framework:4.7.1 cpe:/a:microsoft:.net_framework:4.7.2 cpe:/a:microsoft:.net_framework:4.8 cpe:/a:microsoft:identitymodel:7.0.0 cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1 cpe:/a:microsoft:sharepoint_enterprise_server:2016 cpe:/a:microsoft:sharepoint_foundation:2010:sp2 cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2019 cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-1006

2019-07-15T15:15:16.390-04:00

2019-07-19T11:52:51.853-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-16T10:40:35.207-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006 An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.

cpe:/a:verifone:verix_multi-app_conductor:2.7

CVE-2019-10060

2019-03-25T20:29:02.193-04:00

2019-03-28T12:20:04.557-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-03-28T12:15:43.480-04:00

MISC https://github.com/VerSprite/research/blob/master/advisories/VS-2019-002.md The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code via a long configuration key value. An attacker must be able to download files to the device in order to exploit this vulnerability.

cpe:/a:node-opencv_project:node-opencv:-::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.1::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.2::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.3::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.4::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.5::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.6::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.7::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.8::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.9::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.10::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.11::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.0.12::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.1.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.2.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.3.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.3.1::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.4.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.5.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.6.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:0.7.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:1.0.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:1.0.2::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:2.0.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:3.0.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:3.1.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:3.2.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:4.0.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:5.0.0::~~~node.js~~ cpe:/a:node-opencv_project:node-opencv:6.0.0::~~~node.js~~

CVE-2019-10061

2019-03-25T21:29:00.710-04:00

2019-04-01T14:54:40.507-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-01T14:37:55.027-04:00

MISC https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b MISC https://github.com/peterbraden/node-opencv/commit/aaece6921d7368577511f06c94c99dd4e9653563 MISC https://www.npmjs.com/advisories/789 utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.

cpe:/a:flatpak:flatpak:0.1 cpe:/a:flatpak:flatpak:0.2 cpe:/a:flatpak:flatpak:0.2.1 cpe:/a:flatpak:flatpak:0.3 cpe:/a:flatpak:flatpak:0.3.1 cpe:/a:flatpak:flatpak:0.3.2 cpe:/a:flatpak:flatpak:0.3.3 cpe:/a:flatpak:flatpak:0.3.4 cpe:/a:flatpak:flatpak:0.3.5 cpe:/a:flatpak:flatpak:0.3.6 cpe:/a:flatpak:flatpak:0.4.0 cpe:/a:flatpak:flatpak:0.4.1 cpe:/a:flatpak:flatpak:0.4.2 cpe:/a:flatpak:flatpak:0.4.2.1 cpe:/a:flatpak:flatpak:0.4.3 cpe:/a:flatpak:flatpak:0.4.4 cpe:/a:flatpak:flatpak:0.4.5 cpe:/a:flatpak:flatpak:0.4.6 cpe:/a:flatpak:flatpak:0.4.7 cpe:/a:flatpak:flatpak:0.4.8 cpe:/a:flatpak:flatpak:0.4.9 cpe:/a:flatpak:flatpak:0.4.10 cpe:/a:flatpak:flatpak:0.4.11 cpe:/a:flatpak:flatpak:0.4.12 cpe:/a:flatpak:flatpak:0.4.13 cpe:/a:flatpak:flatpak:0.5.0 cpe:/a:flatpak:flatpak:0.5.1 cpe:/a:flatpak:flatpak:0.5.2 cpe:/a:flatpak:flatpak:0.6.0 cpe:/a:flatpak:flatpak:0.6.1 cpe:/a:flatpak:flatpak:0.6.2 cpe:/a:flatpak:flatpak:0.6.3 cpe:/a:flatpak:flatpak:0.6.4 cpe:/a:flatpak:flatpak:0.6.5 cpe:/a:flatpak:flatpak:0.6.6 cpe:/a:flatpak:flatpak:0.6.7 cpe:/a:flatpak:flatpak:0.6.8 cpe:/a:flatpak:flatpak:0.6.9 cpe:/a:flatpak:flatpak:0.6.10 cpe:/a:flatpak:flatpak:0.6.11 cpe:/a:flatpak:flatpak:0.6.12 cpe:/a:flatpak:flatpak:0.6.13 cpe:/a:flatpak:flatpak:0.6.14 cpe:/a:flatpak:flatpak:0.8.0 cpe:/a:flatpak:flatpak:0.8.1 cpe:/a:flatpak:flatpak:0.8.2 cpe:/a:flatpak:flatpak:0.8.3 cpe:/a:flatpak:flatpak:0.8.4 cpe:/a:flatpak:flatpak:0.8.5 cpe:/a:flatpak:flatpak:0.8.6 cpe:/a:flatpak:flatpak:0.8.7 cpe:/a:flatpak:flatpak:0.8.8 cpe:/a:flatpak:flatpak:0.8.9 cpe:/a:flatpak:flatpak:0.9.1 cpe:/a:flatpak:flatpak:0.9.2 cpe:/a:flatpak:flatpak:0.9.3 cpe:/a:flatpak:flatpak:0.9.4 cpe:/a:flatpak:flatpak:0.9.5 cpe:/a:flatpak:flatpak:0.9.6 cpe:/a:flatpak:flatpak:0.9.7 cpe:/a:flatpak:flatpak:0.9.8 cpe:/a:flatpak:flatpak:0.9.9 cpe:/a:flatpak:flatpak:0.9.10 cpe:/a:flatpak:flatpak:0.9.11 cpe:/a:flatpak:flatpak:0.9.12 cpe:/a:flatpak:flatpak:0.9.98 cpe:/a:flatpak:flatpak:0.9.98.1 cpe:/a:flatpak:flatpak:0.9.98.2 cpe:/a:flatpak:flatpak:0.9.99 cpe:/a:flatpak:flatpak:0.10.0 cpe:/a:flatpak:flatpak:0.10.1 cpe:/a:flatpak:flatpak:0.10.2 cpe:/a:flatpak:flatpak:0.10.2.1 cpe:/a:flatpak:flatpak:0.10.3 cpe:/a:flatpak:flatpak:0.10.4 cpe:/a:flatpak:flatpak:0.11.1 cpe:/a:flatpak:flatpak:0.11.2 cpe:/a:flatpak:flatpak:0.11.3 cpe:/a:flatpak:flatpak:0.11.4 cpe:/a:flatpak:flatpak:0.11.5 cpe:/a:flatpak:flatpak:0.11.6 cpe:/a:flatpak:flatpak:0.11.7 cpe:/a:flatpak:flatpak:0.11.8 cpe:/a:flatpak:flatpak:0.11.8.1 cpe:/a:flatpak:flatpak:0.11.8.2 cpe:/a:flatpak:flatpak:0.11.8.3 cpe:/a:flatpak:flatpak:0.99.1 cpe:/a:flatpak:flatpak:0.99.2 cpe:/a:flatpak:flatpak:0.99.3 cpe:/a:flatpak:flatpak:1.0.0 cpe:/a:flatpak:flatpak:1.0.1 cpe:/a:flatpak:flatpak:1.0.2 cpe:/a:flatpak:flatpak:1.0.3 cpe:/a:flatpak:flatpak:1.0.4 cpe:/a:flatpak:flatpak:1.0.5 cpe:/a:flatpak:flatpak:1.0.6 cpe:/a:flatpak:flatpak:1.0.7 cpe:/a:flatpak:flatpak:1.1.0 cpe:/a:flatpak:flatpak:1.1.1 cpe:/a:flatpak:flatpak:1.1.2 cpe:/a:flatpak:flatpak:1.1.3 cpe:/a:flatpak:flatpak:1.2.0 cpe:/a:flatpak:flatpak:1.2.1 cpe:/a:flatpak:flatpak:1.2.2 cpe:/a:flatpak:flatpak:1.2.3 cpe:/a:flatpak:flatpak:1.3.0

CVE-2019-10063

2019-03-26T10:29:00.240-04:00

2019-05-13T06:29:02.193-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2019:1024 REDHAT RHSA-2019:1143 MISC https://github.com/flatpak/flatpak/issues/2782 Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

CVE-2019-10066

2019-05-21T20:29:00.573-04:00

2019-05-22T09:51:17.307-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-22T08:07:08.710-04:00

CONFIRM https://community.otrs.com/security-advisory-2019-06-security-update-for-otrs-framework/ An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS.

cpe:/a:otrs:otrs:5.0.0:- cpe:/a:otrs:otrs:5.0.0:-:~~community~~~ cpe:/a:otrs:otrs:5.0.0:alpha1 cpe:/a:otrs:otrs:5.0.0:alpha1:~~community~~~ cpe:/a:otrs:otrs:5.0.0:beta1 cpe:/a:otrs:otrs:5.0.0:beta1:~~community~~~ cpe:/a:otrs:otrs:5.0.0:beta2 cpe:/a:otrs:otrs:5.0.0:beta2:~~community~~~ cpe:/a:otrs:otrs:5.0.0:beta3 cpe:/a:otrs:otrs:5.0.0:beta3:~~community~~~ cpe:/a:otrs:otrs:5.0.0:beta4 cpe:/a:otrs:otrs:5.0.0:beta4:~~community~~~ cpe:/a:otrs:otrs:5.0.0:beta5 cpe:/a:otrs:otrs:5.0.0:beta5:~~community~~~ cpe:/a:otrs:otrs:5.0.0:rc1 cpe:/a:otrs:otrs:5.0.0:rc1:~~community~~~ cpe:/a:otrs:otrs:5.0.1 cpe:/a:otrs:otrs:5.0.1::~~community~~~ cpe:/a:otrs:otrs:5.0.2 cpe:/a:otrs:otrs:5.0.2::~~community~~~ cpe:/a:otrs:otrs:5.0.3 cpe:/a:otrs:otrs:5.0.3::~~community~~~ cpe:/a:otrs:otrs:5.0.4 cpe:/a:otrs:otrs:5.0.4::~~community~~~ cpe:/a:otrs:otrs:5.0.5 cpe:/a:otrs:otrs:5.0.5::~~community~~~ cpe:/a:otrs:otrs:5.0.6 cpe:/a:otrs:otrs:5.0.6::~~community~~~ cpe:/a:otrs:otrs:5.0.7 cpe:/a:otrs:otrs:5.0.7::~~community~~~ cpe:/a:otrs:otrs:5.0.8 cpe:/a:otrs:otrs:5.0.8::~~community~~~ cpe:/a:otrs:otrs:5.0.9 cpe:/a:otrs:otrs:5.0.9::~~community~~~ cpe:/a:otrs:otrs:5.0.10 cpe:/a:otrs:otrs:5.0.10::~~community~~~ cpe:/a:otrs:otrs:5.0.11 cpe:/a:otrs:otrs:5.0.11::~~community~~~ cpe:/a:otrs:otrs:5.0.12 cpe:/a:otrs:otrs:5.0.12::~~community~~~ cpe:/a:otrs:otrs:5.0.13 cpe:/a:otrs:otrs:5.0.13::~~community~~~ cpe:/a:otrs:otrs:5.0.14 cpe:/a:otrs:otrs:5.0.14::~~community~~~ cpe:/a:otrs:otrs:5.0.15 cpe:/a:otrs:otrs:5.0.15::~~community~~~ cpe:/a:otrs:otrs:5.0.16 cpe:/a:otrs:otrs:5.0.16::~~community~~~ cpe:/a:otrs:otrs:5.0.17 cpe:/a:otrs:otrs:5.0.17::~~community~~~ cpe:/a:otrs:otrs:5.0.18 cpe:/a:otrs:otrs:5.0.18::~~community~~~ cpe:/a:otrs:otrs:5.0.19 cpe:/a:otrs:otrs:5.0.19::~~community~~~ cpe:/a:otrs:otrs:5.0.20 cpe:/a:otrs:otrs:5.0.20::~~community~~~ cpe:/a:otrs:otrs:5.0.21 cpe:/a:otrs:otrs:5.0.21::~~community~~~ cpe:/a:otrs:otrs:5.0.22 cpe:/a:otrs:otrs:5.0.22::~~community~~~ cpe:/a:otrs:otrs:5.0.23 cpe:/a:otrs:otrs:5.0.23::~~community~~~ cpe:/a:otrs:otrs:5.0.24 cpe:/a:otrs:otrs:5.0.24::~~community~~~ cpe:/a:otrs:otrs:5.0.25 cpe:/a:otrs:otrs:5.0.25::~~community~~~ cpe:/a:otrs:otrs:5.0.26 cpe:/a:otrs:otrs:5.0.26::~~community~~~ cpe:/a:otrs:otrs:5.0.27 cpe:/a:otrs:otrs:5.0.27::~~community~~~ cpe:/a:otrs:otrs:5.0.28 cpe:/a:otrs:otrs:5.0.28::~~community~~~ cpe:/a:otrs:otrs:5.0.29 cpe:/a:otrs:otrs:5.0.29::~~community~~~ cpe:/a:otrs:otrs:5.0.30 cpe:/a:otrs:otrs:5.0.30::~~community~~~ cpe:/a:otrs:otrs:5.0.31 cpe:/a:otrs:otrs:5.0.31::~~community~~~ cpe:/a:otrs:otrs:5.0.32 cpe:/a:otrs:otrs:5.0.32::~~community~~~ cpe:/a:otrs:otrs:5.0.33 cpe:/a:otrs:otrs:5.0.33::~~community~~~ cpe:/a:otrs:otrs:5.0.34 cpe:/a:otrs:otrs:5.0.34::~~community~~~ cpe:/a:otrs:otrs:5.0.35 cpe:/a:otrs:otrs:5.0.35::~~community~~~ cpe:/a:otrs:otrs:6.0.0 cpe:/a:otrs:otrs:6.0.0:-:~~community~~~ cpe:/a:otrs:otrs:6.0.0:alpha1 cpe:/a:otrs:otrs:6.0.0:alpha1:~~community~~~ cpe:/a:otrs:otrs:6.0.0:beta1 cpe:/a:otrs:otrs:6.0.0:beta1:~~community~~~ cpe:/a:otrs:otrs:6.0.0:beta2 cpe:/a:otrs:otrs:6.0.0:beta2:~~community~~~ cpe:/a:otrs:otrs:6.0.0:beta3 cpe:/a:otrs:otrs:6.0.0:beta3:~~community~~~ cpe:/a:otrs:otrs:6.0.0:beta4 cpe:/a:otrs:otrs:6.0.0:beta4:~~community~~~ cpe:/a:otrs:otrs:6.0.0:beta5 cpe:/a:otrs:otrs:6.0.0:beta5:~~community~~~ cpe:/a:otrs:otrs:6.0.0:rc1 cpe:/a:otrs:otrs:6.0.0:rc1:~~community~~~ cpe:/a:otrs:otrs:6.0.1 cpe:/a:otrs:otrs:6.0.1::~~community~~~ cpe:/a:otrs:otrs:6.0.2 cpe:/a:otrs:otrs:6.0.2::~~community~~~ cpe:/a:otrs:otrs:6.0.3 cpe:/a:otrs:otrs:6.0.3::~~community~~~ cpe:/a:otrs:otrs:6.0.4 cpe:/a:otrs:otrs:6.0.4::~~community~~~ cpe:/a:otrs:otrs:6.0.5 cpe:/a:otrs:otrs:6.0.5::~~community~~~ cpe:/a:otrs:otrs:6.0.6 cpe:/a:otrs:otrs:6.0.6::~~community~~~ cpe:/a:otrs:otrs:6.0.7 cpe:/a:otrs:otrs:6.0.7::~~community~~~ cpe:/a:otrs:otrs:6.0.8 cpe:/a:otrs:otrs:6.0.8::~~community~~~ cpe:/a:otrs:otrs:6.0.9 cpe:/a:otrs:otrs:6.0.9::~~community~~~ cpe:/a:otrs:otrs:6.0.10 cpe:/a:otrs:otrs:6.0.10::~~community~~~ cpe:/a:otrs:otrs:6.0.11 cpe:/a:otrs:otrs:6.0.11::~~community~~~ cpe:/a:otrs:otrs:6.0.12 cpe:/a:otrs:otrs:6.0.12::~~community~~~ cpe:/a:otrs:otrs:6.0.13 cpe:/a:otrs:otrs:6.0.13::~~community~~~ cpe:/a:otrs:otrs:6.0.14 cpe:/a:otrs:otrs:6.0.14::~~community~~~ cpe:/a:otrs:otrs:6.0.15 cpe:/a:otrs:otrs:6.0.15::~~community~~~ cpe:/a:otrs:otrs:6.0.16 cpe:/a:otrs:otrs:6.0.16::~~community~~~ cpe:/a:otrs:otrs:6.0.17 cpe:/a:otrs:otrs:6.0.17::~~community~~~ cpe:/a:otrs:otrs:7.0.0 cpe:/a:otrs:otrs:7.0.0::~~community~~~ cpe:/a:otrs:otrs:7.0.4 cpe:/a:otrs:otrs:7.0.5 cpe:/a:otrs:otrs:7.0.6

CVE-2019-10067

2019-05-21T20:29:00.617-04:00

2019-05-22T09:51:09.370-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-22T08:00:32.907-04:00

CONFIRM https://community.otrs.com/security-advisory-2019-05-security-update-for-otrs-framework/ An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS.

cpe:/a:kentico:kentico:4.0.1 cpe:/a:kentico:kentico:4.0.2 cpe:/a:kentico:kentico:4.0.3 cpe:/a:kentico:kentico:4.0.4 cpe:/a:kentico:kentico:4.0.5 cpe:/a:kentico:kentico:4.0.6 cpe:/a:kentico:kentico:4.0.7 cpe:/a:kentico:kentico:4.0.8 cpe:/a:kentico:kentico:4.0.9 cpe:/a:kentico:kentico:4.0.10 cpe:/a:kentico:kentico:4.0.11 cpe:/a:kentico:kentico:4.0.12 cpe:/a:kentico:kentico:4.0.13 cpe:/a:kentico:kentico:4.0.14 cpe:/a:kentico:kentico:4.0.15 cpe:/a:kentico:kentico:4.1.1 cpe:/a:kentico:kentico:4.1.2 cpe:/a:kentico:kentico:4.1.3 cpe:/a:kentico:kentico:4.1.4 cpe:/a:kentico:kentico:4.1.5 cpe:/a:kentico:kentico:4.1.6 cpe:/a:kentico:kentico:4.1.7 cpe:/a:kentico:kentico:4.1.8 cpe:/a:kentico:kentico:4.1.9 cpe:/a:kentico:kentico:4.1.10 cpe:/a:kentico:kentico:4.1.11 cpe:/a:kentico:kentico:4.1.12 cpe:/a:kentico:kentico:4.1.13 cpe:/a:kentico:kentico:4.1.14 cpe:/a:kentico:kentico:4.1.15 cpe:/a:kentico:kentico:4.1.16 cpe:/a:kentico:kentico:4.1.17 cpe:/a:kentico:kentico:4.1.18 cpe:/a:kentico:kentico:4.1.19 cpe:/a:kentico:kentico:4.1.20 cpe:/a:kentico:kentico:4.1.21 cpe:/a:kentico:kentico:5.0.1 cpe:/a:kentico:kentico:5.0.2 cpe:/a:kentico:kentico:5.0.3 cpe:/a:kentico:kentico:5.0.4 cpe:/a:kentico:kentico:5.0.5 cpe:/a:kentico:kentico:5.0.6 cpe:/a:kentico:kentico:5.0.7 cpe:/a:kentico:kentico:5.0.8 cpe:/a:kentico:kentico:5.0.9 cpe:/a:kentico:kentico:5.0.10 cpe:/a:kentico:kentico:5.0.11 cpe:/a:kentico:kentico:5.0.12 cpe:/a:kentico:kentico:5.0.13 cpe:/a:kentico:kentico:5.0.14 cpe:/a:kentico:kentico:5.0.15 cpe:/a:kentico:kentico:5.0.16 cpe:/a:kentico:kentico:5.0.17 cpe:/a:kentico:kentico:5.0.18 cpe:/a:kentico:kentico:5.0.19 cpe:/a:kentico:kentico:5.5.1 cpe:/a:kentico:kentico:5.5.2 cpe:/a:kentico:kentico:5.5.3 cpe:/a:kentico:kentico:5.5.4 cpe:/a:kentico:kentico:5.5.5 cpe:/a:kentico:kentico:5.5.6 cpe:/a:kentico:kentico:5.5.7 cpe:/a:kentico:kentico:5.5.8 cpe:/a:kentico:kentico:5.5.9 cpe:/a:kentico:kentico:5.5.10 cpe:/a:kentico:kentico:5.5.11 cpe:/a:kentico:kentico:5.5.12 cpe:/a:kentico:kentico:5.5.13 cpe:/a:kentico:kentico:5.5.14 cpe:/a:kentico:kentico:5.5.15 cpe:/a:kentico:kentico:5.5.16 cpe:/a:kentico:kentico:5.5.17 cpe:/a:kentico:kentico:5.5.18 cpe:/a:kentico:kentico:5.5.19 cpe:/a:kentico:kentico:5.5.20 cpe:/a:kentico:kentico:5.5.21 cpe:/a:kentico:kentico:5.5.22 cpe:/a:kentico:kentico:5.5.23 cpe:/a:kentico:kentico:5.5.24 cpe:/a:kentico:kentico:5.5.25 cpe:/a:kentico:kentico:5.5.26 cpe:/a:kentico:kentico:5.5.27 cpe:/a:kentico:kentico:5.5.28 cpe:/a:kentico:kentico:5.5.29 cpe:/a:kentico:kentico:5.5.30 cpe:/a:kentico:kentico:6.0.16 cpe:/a:kentico:kentico:6.0.17 cpe:/a:kentico:kentico:6.0.18 cpe:/a:kentico:kentico:6.0.19 cpe:/a:kentico:kentico:6.0.20 cpe:/a:kentico:kentico:6.0.21 cpe:/a:kentico:kentico:6.0.22 cpe:/a:kentico:kentico:6.0.23 cpe:/a:kentico:kentico:6.0.24 cpe:/a:kentico:kentico:6.0.25 cpe:/a:kentico:kentico:6.0.26 cpe:/a:kentico:kentico:6.0.27 cpe:/a:kentico:kentico:6.0.28 cpe:/a:kentico:kentico:6.0.29 cpe:/a:kentico:kentico:6.0.30 cpe:/a:kentico:kentico:6.0.31 cpe:/a:kentico:kentico:6.0.32 cpe:/a:kentico:kentico:6.0.33 cpe:/a:kentico:kentico:6.0.34 cpe:/a:kentico:kentico:6.0.35 cpe:/a:kentico:kentico:6.0.36 cpe:/a:kentico:kentico:6.0.37 cpe:/a:kentico:kentico:6.0.38 cpe:/a:kentico:kentico:6.0.39 cpe:/a:kentico:kentico:6.0.40 cpe:/a:kentico:kentico:6.0.41 cpe:/a:kentico:kentico:6.0.42 cpe:/a:kentico:kentico:6.0.43 cpe:/a:kentico:kentico:6.0.44 cpe:/a:kentico:kentico:6.0.45 cpe:/a:kentico:kentico:6.0.46 cpe:/a:kentico:kentico:6.0.47 cpe:/a:kentico:kentico:6.0.48 cpe:/a:kentico:kentico:6.0.49 cpe:/a:kentico:kentico:6.0.50 cpe:/a:kentico:kentico:6.0.51 cpe:/a:kentico:kentico:6.0.52 cpe:/a:kentico:kentico:6.0.53 cpe:/a:kentico:kentico:6.0.54 cpe:/a:kentico:kentico:6.0.55 cpe:/a:kentico:kentico:6.0.56 cpe:/a:kentico:kentico:6.0.57 cpe:/a:kentico:kentico:6.0.58 cpe:/a:kentico:kentico:7.0.1 cpe:/a:kentico:kentico:7.0.2 cpe:/a:kentico:kentico:7.0.3 cpe:/a:kentico:kentico:7.0.4 cpe:/a:kentico:kentico:7.0.5 cpe:/a:kentico:kentico:7.0.6 cpe:/a:kentico:kentico:7.0.7 cpe:/a:kentico:kentico:7.0.8 cpe:/a:kentico:kentico:7.0.9 cpe:/a:kentico:kentico:7.0.10 cpe:/a:kentico:kentico:7.0.11 cpe:/a:kentico:kentico:7.0.12 cpe:/a:kentico:kentico:7.0.13 cpe:/a:kentico:kentico:7.0.14 cpe:/a:kentico:kentico:7.0.15 cpe:/a:kentico:kentico:7.0.16 cpe:/a:kentico:kentico:7.0.17 cpe:/a:kentico:kentico:7.0.18 cpe:/a:kentico:kentico:7.0.19 cpe:/a:kentico:kentico:7.0.20 cpe:/a:kentico:kentico:7.0.21 cpe:/a:kentico:kentico:7.0.22 cpe:/a:kentico:kentico:7.0.23 cpe:/a:kentico:kentico:7.0.24 cpe:/a:kentico:kentico:7.0.26 cpe:/a:kentico:kentico:7.0.27 cpe:/a:kentico:kentico:7.0.28 cpe:/a:kentico:kentico:7.0.29 cpe:/a:kentico:kentico:7.0.30 cpe:/a:kentico:kentico:7.0.31 cpe:/a:kentico:kentico:7.0.32 cpe:/a:kentico:kentico:7.0.33 cpe:/a:kentico:kentico:7.0.34 cpe:/a:kentico:kentico:7.0.35 cpe:/a:kentico:kentico:7.0.36 cpe:/a:kentico:kentico:7.0.37 cpe:/a:kentico:kentico:7.0.38 cpe:/a:kentico:kentico:7.0.39 cpe:/a:kentico:kentico:7.0.40 cpe:/a:kentico:kentico:7.0.41 cpe:/a:kentico:kentico:7.0.42 cpe:/a:kentico:kentico:7.0.43 cpe:/a:kentico:kentico:7.0.44 cpe:/a:kentico:kentico:7.0.45 cpe:/a:kentico:kentico:7.0.46 cpe:/a:kentico:kentico:7.0.47 cpe:/a:kentico:kentico:7.0.48 cpe:/a:kentico:kentico:7.0.49 cpe:/a:kentico:kentico:7.0.50 cpe:/a:kentico:kentico:7.0.51 cpe:/a:kentico:kentico:7.0.52 cpe:/a:kentico:kentico:7.0.53 cpe:/a:kentico:kentico:7.0.54 cpe:/a:kentico:kentico:7.0.55 cpe:/a:kentico:kentico:7.0.56 cpe:/a:kentico:kentico:7.0.57 cpe:/a:kentico:kentico:7.0.58 cpe:/a:kentico:kentico:7.0.59 cpe:/a:kentico:kentico:7.0.60 cpe:/a:kentico:kentico:7.0.61 cpe:/a:kentico:kentico:7.0.62 cpe:/a:kentico:kentico:7.0.63 cpe:/a:kentico:kentico:7.0.64 cpe:/a:kentico:kentico:7.0.65 cpe:/a:kentico:kentico:7.0.66 cpe:/a:kentico:kentico:7.0.67 cpe:/a:kentico:kentico:7.0.68 cpe:/a:kentico:kentico:7.0.69 cpe:/a:kentico:kentico:7.0.70 cpe:/a:kentico:kentico:7.0.71 cpe:/a:kentico:kentico:7.0.72 cpe:/a:kentico:kentico:7.0.73 cpe:/a:kentico:kentico:7.0.74 cpe:/a:kentico:kentico:7.0.75 cpe:/a:kentico:kentico:7.0.76 cpe:/a:kentico:kentico:7.0.77 cpe:/a:kentico:kentico:7.0.78 cpe:/a:kentico:kentico:7.0.79 cpe:/a:kentico:kentico:7.0.80 cpe:/a:kentico:kentico:7.0.81 cpe:/a:kentico:kentico:7.0.82 cpe:/a:kentico:kentico:7.0.83 cpe:/a:kentico:kentico:7.0.84 cpe:/a:kentico:kentico:7.0.85 cpe:/a:kentico:kentico:7.0.86 cpe:/a:kentico:kentico:7.0.87 cpe:/a:kentico:kentico:7.0.88 cpe:/a:kentico:kentico:7.0.89 cpe:/a:kentico:kentico:7.0.90 cpe:/a:kentico:kentico:7.0.91 cpe:/a:kentico:kentico:7.0.92 cpe:/a:kentico:kentico:7.0.93 cpe:/a:kentico:kentico:7.0.94 cpe:/a:kentico:kentico:7.0.95 cpe:/a:kentico:kentico:7.0.96 cpe:/a:kentico:kentico:7.0.97 cpe:/a:kentico:kentico:7.0.98 cpe:/a:kentico:kentico:7.0.99 cpe:/a:kentico:kentico:7.0.100 cpe:/a:kentico:kentico:7.0.101 cpe:/a:kentico:kentico:7.0.102 cpe:/a:kentico:kentico:7.0.103 cpe:/a:kentico:kentico:7.0.104 cpe:/a:kentico:kentico:7.0.105 cpe:/a:kentico:kentico:8.0.1 cpe:/a:kentico:kentico:8.0.2 cpe:/a:kentico:kentico:8.0.3 cpe:/a:kentico:kentico:8.0.4 cpe:/a:kentico:kentico:8.0.5 cpe:/a:kentico:kentico:8.0.6 cpe:/a:kentico:kentico:8.0.7 cpe:/a:kentico:kentico:8.0.8 cpe:/a:kentico:kentico:8.0.9 cpe:/a:kentico:kentico:8.0.10 cpe:/a:kentico:kentico:8.0.11 cpe:/a:kentico:kentico:8.0.12 cpe:/a:kentico:kentico:8.0.13 cpe:/a:kentico:kentico:8.0.14 cpe:/a:kentico:kentico:8.0.15 cpe:/a:kentico:kentico:8.0.16 cpe:/a:kentico:kentico:8.0.17 cpe:/a:kentico:kentico:8.0.18 cpe:/a:kentico:kentico:8.0.19 cpe:/a:kentico:kentico:8.0.20 cpe:/a:kentico:kentico:8.0.21 cpe:/a:kentico:kentico:8.0.22 cpe:/a:kentico:kentico:8.0.23 cpe:/a:kentico:kentico:8.1.1 cpe:/a:kentico:kentico:8.1.2 cpe:/a:kentico:kentico:8.1.3 cpe:/a:kentico:kentico:8.1.4 cpe:/a:kentico:kentico:8.1.5 cpe:/a:kentico:kentico:8.1.6 cpe:/a:kentico:kentico:8.1.7 cpe:/a:kentico:kentico:8.1.8 cpe:/a:kentico:kentico:8.1.9 cpe:/a:kentico:kentico:8.1.10 cpe:/a:kentico:kentico:8.1.11 cpe:/a:kentico:kentico:8.1.12 cpe:/a:kentico:kentico:8.1.13 cpe:/a:kentico:kentico:8.1.14 cpe:/a:kentico:kentico:8.1.15 cpe:/a:kentico:kentico:8.1.16 cpe:/a:kentico:kentico:8.1.17 cpe:/a:kentico:kentico:8.1.18 cpe:/a:kentico:kentico:8.1.19 cpe:/a:kentico:kentico:8.2.1 cpe:/a:kentico:kentico:8.2.2 cpe:/a:kentico:kentico:8.2.3 cpe:/a:kentico:kentico:8.2.4 cpe:/a:kentico:kentico:8.2.5 cpe:/a:kentico:kentico:8.2.6 cpe:/a:kentico:kentico:8.2.7 cpe:/a:kentico:kentico:8.2.10 cpe:/a:kentico:kentico:8.2.11 cpe:/a:kentico:kentico:8.2.12 cpe:/a:kentico:kentico:8.2.13 cpe:/a:kentico:kentico:8.2.14 cpe:/a:kentico:kentico:8.2.15 cpe:/a:kentico:kentico:8.2.16 cpe:/a:kentico:kentico:8.2.17 cpe:/a:kentico:kentico:8.2.18 cpe:/a:kentico:kentico:8.2.19 cpe:/a:kentico:kentico:8.2.20 cpe:/a:kentico:kentico:8.2.21 cpe:/a:kentico:kentico:8.2.22 cpe:/a:kentico:kentico:8.2.23 cpe:/a:kentico:kentico:8.2.24 cpe:/a:kentico:kentico:8.2.25 cpe:/a:kentico:kentico:8.2.26 cpe:/a:kentico:kentico:8.2.27 cpe:/a:kentico:kentico:8.2.28 cpe:/a:kentico:kentico:8.2.29 cpe:/a:kentico:kentico:8.2.30 cpe:/a:kentico:kentico:8.2.33 cpe:/a:kentico:kentico:8.2.34 cpe:/a:kentico:kentico:8.2.35 cpe:/a:kentico:kentico:8.2.36 cpe:/a:kentico:kentico:8.2.37 cpe:/a:kentico:kentico:8.2.38 cpe:/a:kentico:kentico:8.2.39 cpe:/a:kentico:kentico:8.2.40 cpe:/a:kentico:kentico:8.2.41 cpe:/a:kentico:kentico:8.2.42 cpe:/a:kentico:kentico:8.2.43 cpe:/a:kentico:kentico:8.2.44 cpe:/a:kentico:kentico:8.2.45 cpe:/a:kentico:kentico:8.2.46 cpe:/a:kentico:kentico:8.2.47 cpe:/a:kentico:kentico:8.2.48 cpe:/a:kentico:kentico:8.2.49 cpe:/a:kentico:kentico:8.2.50 cpe:/a:kentico:kentico:9.0.0 cpe:/a:kentico:kentico:9.0.0.1 cpe:/a:kentico:kentico:9.0.1 cpe:/a:kentico:kentico:9.0.2 cpe:/a:kentico:kentico:9.0.3 cpe:/a:kentico:kentico:9.0.4 cpe:/a:kentico:kentico:9.0.5 cpe:/a:kentico:kentico:9.0.6 cpe:/a:kentico:kentico:9.0.7 cpe:/a:kentico:kentico:9.0.8 cpe:/a:kentico:kentico:9.0.9 cpe:/a:kentico:kentico:9.0.10 cpe:/a:kentico:kentico:9.0.11 cpe:/a:kentico:kentico:9.0.12 cpe:/a:kentico:kentico:9.0.13 cpe:/a:kentico:kentico:9.0.14 cpe:/a:kentico:kentico:9.0.15 cpe:/a:kentico:kentico:9.0.16 cpe:/a:kentico:kentico:9.0.17 cpe:/a:kentico:kentico:9.0.18 cpe:/a:kentico:kentico:9.0.19 cpe:/a:kentico:kentico:9.0.20 cpe:/a:kentico:kentico:9.0.21 cpe:/a:kentico:kentico:9.0.22 cpe:/a:kentico:kentico:9.0.23 cpe:/a:kentico:kentico:9.0.24 cpe:/a:kentico:kentico:9.0.25 cpe:/a:kentico:kentico:9.0.26 cpe:/a:kentico:kentico:9.0.27 cpe:/a:kentico:kentico:9.0.28 cpe:/a:kentico:kentico:9.0.29 cpe:/a:kentico:kentico:9.0.30 cpe:/a:kentico:kentico:9.0.31 cpe:/a:kentico:kentico:9.0.32.1 cpe:/a:kentico:kentico:9.0.33 cpe:/a:kentico:kentico:9.0.34 cpe:/a:kentico:kentico:9.0.35 cpe:/a:kentico:kentico:9.0.36 cpe:/a:kentico:kentico:9.0.37 cpe:/a:kentico:kentico:9.0.38 cpe:/a:kentico:kentico:9.0.39 cpe:/a:kentico:kentico:9.0.40 cpe:/a:kentico:kentico:9.0.41 cpe:/a:kentico:kentico:9.0.42 cpe:/a:kentico:kentico:9.0.43 cpe:/a:kentico:kentico:9.0.44 cpe:/a:kentico:kentico:9.0.45 cpe:/a:kentico:kentico:9.0.46 cpe:/a:kentico:kentico:9.0.47 cpe:/a:kentico:kentico:9.0.48 cpe:/a:kentico:kentico:9.0.49 cpe:/a:kentico:kentico:9.0.50 cpe:/a:kentico:kentico:9.0.51 cpe:/a:kentico:kentico:10.0.0 cpe:/a:kentico:kentico:10.0.1 cpe:/a:kentico:kentico:10.0.2 cpe:/a:kentico:kentico:10.0.3 cpe:/a:kentico:kentico:10.0.4 cpe:/a:kentico:kentico:10.0.5 cpe:/a:kentico:kentico:10.0.6 cpe:/a:kentico:kentico:10.0.7 cpe:/a:kentico:kentico:10.0.8 cpe:/a:kentico:kentico:10.0.9 cpe:/a:kentico:kentico:10.0.10 cpe:/a:kentico:kentico:10.0.11 cpe:/a:kentico:kentico:10.0.12 cpe:/a:kentico:kentico:10.0.13 cpe:/a:kentico:kentico:10.0.14 cpe:/a:kentico:kentico:10.0.15 cpe:/a:kentico:kentico:10.0.16 cpe:/a:kentico:kentico:10.0.17 cpe:/a:kentico:kentico:10.0.18 cpe:/a:kentico:kentico:10.0.19 cpe:/a:kentico:kentico:10.0.20 cpe:/a:kentico:kentico:10.0.21 cpe:/a:kentico:kentico:10.0.22 cpe:/a:kentico:kentico:10.0.23 cpe:/a:kentico:kentico:10.0.24 cpe:/a:kentico:kentico:10.0.25 cpe:/a:kentico:kentico:10.0.26 cpe:/a:kentico:kentico:10.0.27 cpe:/a:kentico:kentico:10.0.28 cpe:/a:kentico:kentico:10.0.29 cpe:/a:kentico:kentico:10.0.30 cpe:/a:kentico:kentico:10.0.31 cpe:/a:kentico:kentico:10.0.32 cpe:/a:kentico:kentico:10.0.33 cpe:/a:kentico:kentico:10.0.34 cpe:/a:kentico:kentico:10.0.35 cpe:/a:kentico:kentico:10.0.36 cpe:/a:kentico:kentico:10.0.37 cpe:/a:kentico:kentico:10.0.38 cpe:/a:kentico:kentico:10.0.39 cpe:/a:kentico:kentico:10.0.40 cpe:/a:kentico:kentico:10.0.41 cpe:/a:kentico:kentico:10.0.42 cpe:/a:kentico:kentico:10.0.43 cpe:/a:kentico:kentico:10.0.44 cpe:/a:kentico:kentico:10.0.45 cpe:/a:kentico:kentico:10.0.46 cpe:/a:kentico:kentico:10.0.47 cpe:/a:kentico:kentico:10.0.48 cpe:/a:kentico:kentico:10.0.49 cpe:/a:kentico:kentico:10.0.50 cpe:/a:kentico:kentico:10.0.51 cpe:/a:kentico:kentico:11.0.0 cpe:/a:kentico:kentico:11.0.1 cpe:/a:kentico:kentico:11.0.2 cpe:/a:kentico:kentico:11.0.3 cpe:/a:kentico:kentico:11.0.4 cpe:/a:kentico:kentico:11.0.5 cpe:/a:kentico:kentico:11.0.6 cpe:/a:kentico:kentico:11.0.7 cpe:/a:kentico:kentico:11.0.8 cpe:/a:kentico:kentico:11.0.9 cpe:/a:kentico:kentico:11.0.10 cpe:/a:kentico:kentico:11.0.11 cpe:/a:kentico:kentico:11.0.12 cpe:/a:kentico:kentico:11.0.13 cpe:/a:kentico:kentico:11.0.14 cpe:/a:kentico:kentico:11.0.15 cpe:/a:kentico:kentico:11.0.16 cpe:/a:kentico:kentico:11.0.17 cpe:/a:kentico:kentico:11.0.18 cpe:/a:kentico:kentico:11.0.19 cpe:/a:kentico:kentico:11.0.20 cpe:/a:kentico:kentico:11.0.21 cpe:/a:kentico:kentico:11.0.22 cpe:/a:kentico:kentico:11.0.23 cpe:/a:kentico:kentico:11.0.24 cpe:/a:kentico:kentico:11.0.25 cpe:/a:kentico:kentico:11.0.26 cpe:/a:kentico:kentico:11.0.27 cpe:/a:kentico:kentico:11.0.28 cpe:/a:kentico:kentico:11.0.29 cpe:/a:kentico:kentico:11.0.30 cpe:/a:kentico:kentico:11.0.31 cpe:/a:kentico:kentico:11.0.32 cpe:/a:kentico:kentico:11.0.33 cpe:/a:kentico:kentico:11.0.34 cpe:/a:kentico:kentico:11.0.35 cpe:/a:kentico:kentico:11.0.36 cpe:/a:kentico:kentico:11.0.37 cpe:/a:kentico:kentico:11.0.38 cpe:/a:kentico:kentico:11.0.39 cpe:/a:kentico:kentico:11.0.40 cpe:/a:kentico:kentico:11.0.41 cpe:/a:kentico:kentico:11.0.42 cpe:/a:kentico:kentico:11.0.43 cpe:/a:kentico:kentico:11.0.44 cpe:/a:kentico:kentico:11.0.45 cpe:/a:kentico:kentico:11.0.46 cpe:/a:kentico:kentico:11.0.47 cpe:/a:kentico:kentico:12.0 cpe:/a:kentico:kentico:12.0.0 cpe:/a:kentico:kentico:12.0.1 cpe:/a:kentico:kentico:12.0.2 cpe:/a:kentico:kentico:12.0.3 cpe:/a:kentico:kentico:12.0.4 cpe:/a:kentico:kentico:12.0.5 cpe:/a:kentico:kentico:12.0.6 cpe:/a:kentico:kentico:12.0.7 cpe:/a:kentico:kentico:12.0.8 cpe:/a:kentico:kentico:12.0.9 cpe:/a:kentico:kentico:12.0.10 cpe:/a:kentico:kentico:12.0.11 cpe:/a:kentico:kentico:12.0.12 cpe:/a:kentico:kentico:12.0.13 cpe:/a:kentico:kentico:12.0.14

CVE-2019-10068

2019-03-26T14:29:00.403-04:00

2019-04-01T09:52:13.400-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-04-01T08:24:17.390-04:00

MISC https://devnet.kentico.com/download/hotfixes#securityBugs-v12 An issue was discovered in Kentico before 12.0.15. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.

cpe:/a:godotengine:godot:1.0 cpe:/a:godotengine:godot:1.1 cpe:/a:godotengine:godot:2.0 cpe:/a:godotengine:godot:2.0.1 cpe:/a:godotengine:godot:2.0.2 cpe:/a:godotengine:godot:2.0.3 cpe:/a:godotengine:godot:2.0.4 cpe:/a:godotengine:godot:2.0.4.1 cpe:/a:godotengine:godot:2.0.6 cpe:/a:godotengine:godot:2.1.1 cpe:/a:godotengine:godot:2.1.2 cpe:/a:godotengine:godot:2.1.3 cpe:/a:godotengine:godot:2.1.4 cpe:/a:godotengine:godot:2.1.5 cpe:/a:godotengine:godot:3.0 cpe:/a:godotengine:godot:3.0.1 cpe:/a:godotengine:godot:3.0.2 cpe:/a:godotengine:godot:3.0.3 cpe:/a:godotengine:godot:3.0.4 cpe:/a:godotengine:godot:3.0.5 cpe:/a:godotengine:godot:3.1

CVE-2019-10069

2019-05-31T18:29:01.160-04:00

2019-06-03T11:37:54.140-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-03T11:04:14.177-04:00

MISC https://github.com/godotengine/godot/pull/27398 MISC https://godotengine.org/news In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.

CVE-2019-1007

2019-06-12T10:29:02.603-04:00

2019-06-13T09:26:55.047-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-06-13T08:24:07.363-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1007 An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1021, CVE-2019-1022, CVE-2019-1026, CVE-2019-1027, CVE-2019-1028.

cpe:/a:apache:tapestry:5.4.0 cpe:/a:apache:tapestry:5.4.1 cpe:/a:apache:tapestry:5.4.2 cpe:/a:apache:tapestry:5.4.3

CVE-2019-10071

2019-09-16T14:15:10.360-04:00

2019-10-07T12:15:11.100-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [tapestry-users] 20190913 CVE-2019-10071: Apache Tapestry vulnerability disclosure MLIST [tapestry-users] 20191014 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure MLIST [tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.

cpe:/a:apache:tomcat:8.5.0 cpe:/a:apache:tomcat:8.5.1 cpe:/a:apache:tomcat:8.5.2 cpe:/a:apache:tomcat:8.5.3 cpe:/a:apache:tomcat:8.5.4 cpe:/a:apache:tomcat:8.5.5 cpe:/a:apache:tomcat:8.5.6 cpe:/a:apache:tomcat:8.5.7 cpe:/a:apache:tomcat:8.5.8 cpe:/a:apache:tomcat:8.5.9 cpe:/a:apache:tomcat:8.5.10 cpe:/a:apache:tomcat:8.5.11 cpe:/a:apache:tomcat:8.5.12 cpe:/a:apache:tomcat:8.5.13 cpe:/a:apache:tomcat:8.5.14 cpe:/a:apache:tomcat:8.5.15 cpe:/a:apache:tomcat:8.5.16 cpe:/a:apache:tomcat:8.5.17 cpe:/a:apache:tomcat:8.5.18 cpe:/a:apache:tomcat:8.5.19 cpe:/a:apache:tomcat:8.5.20 cpe:/a:apache:tomcat:8.5.21 cpe:/a:apache:tomcat:8.5.22 cpe:/a:apache:tomcat:8.5.23 cpe:/a:apache:tomcat:8.5.24 cpe:/a:apache:tomcat:8.5.25 cpe:/a:apache:tomcat:8.5.26 cpe:/a:apache:tomcat:8.5.27 cpe:/a:apache:tomcat:8.5.28 cpe:/a:apache:tomcat:8.5.29 cpe:/a:apache:tomcat:8.5.30 cpe:/a:apache:tomcat:8.5.31 cpe:/a:apache:tomcat:8.5.32 cpe:/a:apache:tomcat:8.5.33 cpe:/a:apache:tomcat:8.5.34 cpe:/a:apache:tomcat:8.5.35 cpe:/a:apache:tomcat:8.5.36 cpe:/a:apache:tomcat:8.5.37 cpe:/a:apache:tomcat:8.5.38 cpe:/a:apache:tomcat:8.5.39 cpe:/a:apache:tomcat:8.5.40 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/a:apache:tomcat:9.0.0:m10 cpe:/a:apache:tomcat:9.0.0:m11 cpe:/a:apache:tomcat:9.0.0:m12 cpe:/a:apache:tomcat:9.0.0:m13 cpe:/a:apache:tomcat:9.0.0:m14 cpe:/a:apache:tomcat:9.0.0:m15 cpe:/a:apache:tomcat:9.0.0:m16 cpe:/a:apache:tomcat:9.0.0:m17 cpe:/a:apache:tomcat:9.0.0:m18 cpe:/a:apache:tomcat:9.0.0:m19 cpe:/a:apache:tomcat:9.0.0:m2 cpe:/a:apache:tomcat:9.0.0:m20 cpe:/a:apache:tomcat:9.0.0:m21 cpe:/a:apache:tomcat:9.0.0:m22 cpe:/a:apache:tomcat:9.0.0:m23 cpe:/a:apache:tomcat:9.0.0:m24 cpe:/a:apache:tomcat:9.0.0:m25 cpe:/a:apache:tomcat:9.0.0:m26 cpe:/a:apache:tomcat:9.0.0:m27 cpe:/a:apache:tomcat:9.0.0:m3 cpe:/a:apache:tomcat:9.0.0:m4 cpe:/a:apache:tomcat:9.0.0:m5 cpe:/a:apache:tomcat:9.0.0:m6 cpe:/a:apache:tomcat:9.0.0:m7 cpe:/a:apache:tomcat:9.0.0:m8 cpe:/a:apache:tomcat:9.0.0:m9 cpe:/a:apache:tomcat:9.0.1 cpe:/a:apache:tomcat:9.0.2 cpe:/a:apache:tomcat:9.0.3 cpe:/a:apache:tomcat:9.0.4 cpe:/a:apache:tomcat:9.0.5 cpe:/a:apache:tomcat:9.0.6 cpe:/a:apache:tomcat:9.0.7 cpe:/a:apache:tomcat:9.0.8 cpe:/a:apache:tomcat:9.0.9 cpe:/a:apache:tomcat:9.0.10 cpe:/a:apache:tomcat:9.0.11 cpe:/a:apache:tomcat:9.0.12 cpe:/a:apache:tomcat:9.0.13 cpe:/a:apache:tomcat:9.0.14 cpe:/a:apache:tomcat:9.0.15 cpe:/a:apache:tomcat:9.0.16 cpe:/a:apache:tomcat:9.0.17 cpe:/a:apache:tomcat:9.0.19

CVE-2019-10072

2019-06-21T14:15:09.513-04:00

2019-06-25T03:15:09.817-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 108874 MISC https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E CONFIRM https://security.netapp.com/advisory/ntap-20190625-0002/ CONFIRM https://support.f5.com/csp/article/K17321505 UBUNTU USN-4128-1 UBUNTU USN-4128-2 CONFIRM https://www.synology.com/security/advisory/Synology_SA_19_29 The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

cpe:/a:apache:ofbiz:16.11.01 cpe:/a:apache:ofbiz:16.11.02 cpe:/a:apache:ofbiz:16.11.03 cpe:/a:apache:ofbiz:16.11.04 cpe:/a:apache:ofbiz:16.11.05

CVE-2019-10073

2019-09-11T17:15:11.047-04:00

2019-09-13T12:14:15.623-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-13T10:45:49.290-04:00

MLIST [ofbiz-dev] 20190910 [CVE-2019-10073] Apache OFBiz XSS vulnerability in the "ecommerce" component The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616

cpe:/a:apache:ofbiz:16.11.01 cpe:/a:apache:ofbiz:16.11.02 cpe:/a:apache:ofbiz:16.11.03 cpe:/a:apache:ofbiz:16.11.04 cpe:/a:apache:ofbiz:16.11.05

CVE-2019-10074

2019-09-11T17:15:11.157-04:00

2019-09-13T12:14:27.483-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-09-13T10:43:45.690-04:00

MLIST [ofbiz-notifications] 20190913 [jira] [Updated] (OFBIZ-11006) Create customer request screen breaks when entering special characters (CVE-2019-10074) MLIST [ofbiz-dev] 20190910 [CVE-2019-10074] Apache OFBiz RCE (template injection) An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

CVE-2019-10076

2019-05-20T17:29:00.753-04:00

2019-05-23T12:29:08.450-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190519 [CVE-2019-10076] Apache JSPWiki Cross-site scripting vulnerability BID 108437 CONFIRM https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076 MLIST [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.

CVE-2019-10077

2019-05-20T17:29:00.817-04:00

2019-05-23T12:29:08.543-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190519 [CVE-2019-10077] Apache JSPWiki Cross-site scripting vulnerability BID 108437 CONFIRM https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077 MLIST [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.

CVE-2019-10078

2019-05-20T17:29:00.877-04:00

2019-05-23T12:29:08.637-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability BID 108437 CONFIRM https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078 MLIST [jspwiki-dev] 20190519 [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki MLIST [jspwiki-dev] 20190521 Re: [CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki MLIST [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.

cpe:/a:microsoft:dynamics_365:8.2 cpe:/a:microsoft:dynamics_365:9.0 cpe:/a:microsoft:dynamics_crm_2015:7.0

CVE-2019-1008

2019-05-16T15:29:05.257-04:00

2019-05-20T08:59:13.827-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-18T14:33:29.380-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008 A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.

cpe:/a:apache:http_server:2.4.20 cpe:/a:apache:http_server:2.4.21 cpe:/a:apache:http_server:2.4.22 cpe:/a:apache:http_server:2.4.23 cpe:/a:apache:http_server:2.4.24 cpe:/a:apache:http_server:2.4.25 cpe:/a:apache:http_server:2.4.26 cpe:/a:apache:http_server:2.4.27 cpe:/a:apache:http_server:2.4.28 cpe:/a:apache:http_server:2.4.29 cpe:/a:apache:http_server:2.4.30 cpe:/a:apache:http_server:2.4.32 cpe:/a:apache:http_server:2.4.33 cpe:/a:apache:http_server:2.4.34 cpe:/a:apache:http_server:2.4.35 cpe:/a:apache:http_server:2.4.36 cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/a:apache:http_server:2.4.39 cpe:/o:debian:debian_linux:9.0 cpe:/o:debian:debian_linux:10

CVE-2019-10081

2019-08-15T18:15:12.757-04:00

2019-08-30T05:15:17.473-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:2051 MISC https://httpd.apache.org/security/vulnerabilities_24.html BUGTRAQ 20190826 [SECURITY] [DSA 4509-1] apache2 security update GENTOO GLSA-201909-04 CONFIRM https://security.netapp.com/advisory/ntap-20190905-0003/ UBUNTU USN-4113-1 DEBIAN DSA-4509 HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

cpe:/a:apache:http_server:2.4.18 cpe:/a:apache:http_server:2.4.19 cpe:/a:apache:http_server:2.4.20 cpe:/a:apache:http_server:2.4.21 cpe:/a:apache:http_server:2.4.22 cpe:/a:apache:http_server:2.4.23 cpe:/a:apache:http_server:2.4.24 cpe:/a:apache:http_server:2.4.25 cpe:/a:apache:http_server:2.4.26 cpe:/a:apache:http_server:2.4.27 cpe:/a:apache:http_server:2.4.28 cpe:/a:apache:http_server:2.4.29 cpe:/a:apache:http_server:2.4.30 cpe:/a:apache:http_server:2.4.32 cpe:/a:apache:http_server:2.4.33 cpe:/a:apache:http_server:2.4.34 cpe:/a:apache:http_server:2.4.35 cpe:/a:apache:http_server:2.4.36 cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/a:apache:http_server:2.4.39

CVE-2019-10082

2019-09-26T12:15:10.503-04:00

2019-09-27T11:53:25.737-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-09-26T18:07:33.653-04:00

MISC https://httpd.apache.org/security/vulnerabilities_24.html In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

cpe:/a:apache:allura:1.0.0 cpe:/a:apache:allura:1.0.0:- cpe:/a:apache:allura:1.0.0:rc1 cpe:/a:apache:allura:1.0.1 cpe:/a:apache:allura:1.1.0 cpe:/a:apache:allura:1.2.0 cpe:/a:apache:allura:1.2.1 cpe:/a:apache:allura:1.3.0 cpe:/a:apache:allura:1.3.1 cpe:/a:apache:allura:1.3.2 cpe:/a:apache:allura:1.4.0 cpe:/a:apache:allura:1.5.0 cpe:/a:apache:allura:1.6.0 cpe:/a:apache:allura:1.7.0 cpe:/a:apache:allura:1.8.0 cpe:/a:apache:allura:1.8.1 cpe:/a:apache:allura:1.9.0 cpe:/a:apache:allura:1.10.0

CVE-2019-10085

2019-06-18T20:15:12.313-04:00

2019-06-19T16:03:32.607-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-19T08:49:40.983-04:00

BID 108816 MISC https://lists.apache.org/thread.html/88c064c95da2f41d5435ca5b3e364925bed72cc73bcec9b3f25e4c07@%3Cdev.allura.apache.org%3E MLIST [announce] 20190618 CVE-2019-10085 Apache Allura XSS vulnerability In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.

cpe:/a:apache:commons_beanutils:1.9.3 cpe:/o:debian:debian_linux:8.0

CVE-2019-10086

2019-08-20T17:15:12.057-04:00

2019-09-02T20:15:14.250-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:2058 MLIST [www-announce] 20190815 [SECURITY] CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default. MLIST [commons-issues] 20190925 [GitHub] [commons-validator] jeff-schram opened a new pull request #18: Update pom.xml MLIST [commons-issues] 20190906 [jira] [Closed] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. MLIST [shiro-dev] 20191001 [jira] [Created] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fiix MLIST [tinkerpop-commits] 20190829 [tinkerpop] branch master updated: Bump commons-beanutils to 1.9.4 for CVE-2019-10086 - CTR MLIST [commons-issues] 20190906 [jira] [Updated] (CONFIGURATION-755) [CVE-2014-0114] Update Apache Commons BeanUtils from 1.9.3 to 1.9.4. MLIST [shiro-dev] 20191001 [jira] [Commented] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix MLIST [shiro-dev] 20191001 [jira] [Updated] (SHIRO-723) Provide Minor Shiro Release that includes CVE-2019-10086 Fix MLIST [debian-lts-announce] 20190824 [SECURITY] [DLA 1896-1] commons-beanutils security update In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

cpe:/a:apache:jspwiki:2.10.5 cpe:/a:apache:jspwiki:2.11.0:m1 cpe:/a:apache:jspwiki:2.11.0:m1-rc1 cpe:/a:apache:jspwiki:2.11.0:m1-rc2 cpe:/a:apache:jspwiki:2.11.0:m1-rc3 cpe:/a:apache:jspwiki:2.11.0:m2 cpe:/a:apache:jspwiki:2.11.0:m2-rc1 cpe:/a:apache:jspwiki:2.11.0:m3 cpe:/a:apache:jspwiki:2.11.0:m3-rc1 cpe:/a:apache:jspwiki:2.11.0:m3-rc2 cpe:/a:apache:jspwiki:2.11.0:m4 cpe:/a:apache:jspwiki:2.11.0:m4-rc1 cpe:/a:apache:jspwiki:2.11.0:m4-rc2

CVE-2019-10087

2019-09-23T11:15:10.327-04:00

2019-09-23T15:08:17.493-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-23T14:17:08.700-04:00

MISC https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

cpe:/a:apache:tika:1.7 cpe:/a:apache:tika:1.8 cpe:/a:apache:tika:1.9 cpe:/a:apache:tika:1.10 cpe:/a:apache:tika:1.11 cpe:/a:apache:tika:1.12 cpe:/a:apache:tika:1.13 cpe:/a:apache:tika:1.14 cpe:/a:apache:tika:1.15 cpe:/a:apache:tika:1.16 cpe:/a:apache:tika:1.17 cpe:/a:apache:tika:1.18 cpe:/a:apache:tika:1.19 cpe:/a:apache:tika:1.19.1 cpe:/a:apache:tika:1.20 cpe:/a:apache:tika:1.21

CVE-2019-10088

2019-08-02T15:15:11.717-04:00

2019-08-12T15:15:11.203-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://lists.apache.org/thread.html/1c63555609b737c20d1bbfa4a3e73ec488e3408a84e2f5e47e1b7e08@%3Cdev.tika.apache.org%3E MLIST [tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} CONFIRM https://security.netapp.com/advisory/ntap-20190828-0004/ A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.

CVE-2019-10089

2019-09-23T11:15:10.420-04:00

2019-09-23T15:25:00.120-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-23T14:14:30.020-04:00

MISC https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10089 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~

CVE-2019-1009

2019-06-12T10:29:02.633-04:00

2019-08-09T12:15:11.180-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1009 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1010, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.

CVE-2019-10090

2019-09-23T12:15:14.647-04:00

2019-09-23T15:29:04.350-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-23T14:10:54.370-04:00

MISC https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10090 On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

CVE-2019-10092

2019-09-26T12:15:10.613-04:00

2019-09-30T19:15:13.543-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://httpd.apache.org/security/vulnerabilities_24.html MLIST [debian-lts-announce] 20190930 [SECURITY] [DLA 1900-2] apache2 regression update In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

cpe:/a:apache:tika:1.19 cpe:/a:apache:tika:1.19.1 cpe:/a:apache:tika:1.20 cpe:/a:apache:tika:1.21

CVE-2019-10093

2019-08-02T15:15:11.780-04:00

2019-08-12T15:15:11.377-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} CONFIRM https://lists.apache.org/thread.html/a5a44eff1b9eda3bc69d22943a1030c43d376380c75d3ab04d0c1a21@%3Cdev.tika.apache.org%3E MLIST [tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} CONFIRM https://security.netapp.com/advisory/ntap-20190828-0004/ In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.

CVE-2019-10094

2019-08-02T15:15:11.857-04:00

2019-08-12T15:15:11.530-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [tika-dev] 20190813 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190812 Re: security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} MLIST [tika-dev] 20190809 security fixes for CVE-2019-10088 and CVE-2019-1009{3,4} CONFIRM https://lists.apache.org/thread.html/fe876a649d9d36525dd097fe87ff4dcb3b82bb0fbb3a3d71fb72ef61@%3Cdev.tika.apache.org%3E A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.

cpe:/a:apache:http_server:2.4.32 cpe:/a:apache:http_server:2.4.33 cpe:/a:apache:http_server:2.4.34 cpe:/a:apache:http_server:2.4.35 cpe:/a:apache:http_server:2.4.36 cpe:/a:apache:http_server:2.4.37 cpe:/a:apache:http_server:2.4.38 cpe:/a:apache:http_server:2.4.39

CVE-2019-10097

2019-09-26T12:15:10.673-04:00

2019-09-27T14:15:47.273-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-09-26T18:04:57.303-04:00

MISC https://access.redhat.com/security/cve/cve-2019-10097 MISC https://httpd.apache.org/security/vulnerabilities_24.html In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVE-2019-10098

2019-09-25T13:15:10.353-04:00

2019-10-09T19:44:22.257-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://httpd.apache.org/security/vulnerabilities_24.html In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

cpe:/a:apache:spark:1.0.2 cpe:/a:apache:spark:1.1.1 cpe:/a:apache:spark:1.2.1 cpe:/a:apache:spark:1.3.0 cpe:/a:apache:spark:1.3.1 cpe:/a:apache:spark:1.4.0 cpe:/a:apache:spark:1.4.1 cpe:/a:apache:spark:1.5.0 cpe:/a:apache:spark:1.5.1 cpe:/a:apache:spark:1.5.2 cpe:/a:apache:spark:1.6.0 cpe:/a:apache:spark:1.6.1 cpe:/a:apache:spark:1.6.2 cpe:/a:apache:spark:1.6.3 cpe:/a:apache:spark:2.0.0 cpe:/a:apache:spark:2.0.1 cpe:/a:apache:spark:2.0.2 cpe:/a:apache:spark:2.1.0 cpe:/a:apache:spark:2.1.1 cpe:/a:apache:spark:2.1.2 cpe:/a:apache:spark:2.1.3 cpe:/a:apache:spark:2.2.0 cpe:/a:apache:spark:2.2.1 cpe:/a:apache:spark:2.2.2 cpe:/a:apache:spark:2.3.0 cpe:/a:apache:spark:2.3.1

CVE-2019-10099

2019-08-07T13:15:12.073-04:00

2019-08-13T11:49:10.860-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-08T14:45:21.513-04:00

MISC https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_10:1709 cpe:/o:microsoft:windows_10:1803 cpe:/o:microsoft:windows_10:1809 cpe:/o:microsoft:windows_10:1903 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_server_2016:1803 cpe:/o:microsoft:windows_server_2016:1903 cpe:/o:microsoft:windows_server_2019:-

CVE-2019-1010

2019-06-12T10:29:02.650-04:00

2019-06-13T13:19:04.530-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-06-13T10:48:48.740-04:00

MISC https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1010 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0968, CVE-2019-0977, CVE-2019-1009, CVE-2019-1011, CVE-2019-1012, CVE-2019-1013, CVE-2019-1015, CVE-2019-1016, CVE-2019-1046, CVE-2019-1047, CVE-2019-1048, CVE-2019-1049, CVE-2019-1050.

cpe:/a:jetbrains:youtrack_integration:1.6.8.9::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.0::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.1::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.2::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.3::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.5::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.7::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.9::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.10::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.11::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.12::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.13::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.16::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.17::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.18::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.19::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.22::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.7.0.24::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.0.3::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.0.8::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.0.10::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.0.12::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.0.13::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.1.1::~~~confluence~~ cpe:/a:jetbrains:youtrack_integration:1.8.1.2::~~~confluence~~

CVE-2019-10100

2019-07-03T15:15:12.113-04:00

2019-07-09T15:13:12.397-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-05T14:53:58.507-04:00

MISC https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.

cpe:/a:leanote:leanote:0.1 cpe:/a:leanote:leanote:0.2 cpe:/a:leanote:leanote:0.3 cpe:/a:leanote:leanote:0.4 cpe:/a:leanote:leanote:0.5 cpe:/a:leanote:leanote:1.0:- cpe:/a:leanote:leanote:1.0:beta cpe:/a:leanote:leanote:1.0:beta2 cpe:/a:leanote:leanote:1.0:beta3 cpe:/a:leanote:leanote:1.0:beta4 cpe:/a:leanote:leanote:1.0:beta5 cpe:/a:leanote:leanote:1.0.1 cpe:/a:leanote:leanote:1.1 cpe:/a:leanote:leanote:1.2 cpe:/a:leanote:leanote:1.3 cpe:/a:leanote:leanote:1.3.1 cpe:/a:leanote:leanote:1.4 cpe:/a:leanote:leanote:1.4.1 cpe:/a:leanote:leanote:1.4.2 cpe:/a:leanote:leanote:2.0 cpe:/a:leanote:leanote:2.1 cpe:/a:leanote:leanote:2.2 cpe:/a:leanote:leanote:2.2.1 cpe:/a:leanote:leanote:2.2.2 cpe:/a:leanote:leanote:2.3 cpe:/a:leanote:leanote:2.4 cpe:/a:leanote:leanote:2.5

CVE-2019-1010003

2019-07-11T09:15:10.837-04:00

2019-07-12T14:16:31.627-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-11T22:37:21.657-04:00

MISC https://github.com/leanote/leanote/issues/719 Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).

cpe:/a:sound_exchange_project:sound_exchange:14.4.2

CVE-2019-1010004

2019-07-14T22:15:10.213-04:00

2019-08-02T14:31:41.850-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-29T09:31:31.933-04:00

MISC https://sourceforge.net/p/sox/bugs/299/ MISC https://sourceforge.net/p/sox/code/ci/master/tree/src/xa.c#l219 SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:219. The attack vector is: Victim must open specially crafted .xa file. NOTE: this may overlap CVE-2017-18189.

cpe:/a:hexoeditor_project:hexoeditor:1.1.8:beta

CVE-2019-1010005

2019-07-14T22:15:10.293-04:00

2019-07-16T15:55:06.767-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T10:27:36.410-04:00

MISC https://github.com/Moeditor/Moeditor/issues/156 MISC https://github.com/zhuzhuyule/HexoEditor/issues/3 HexoEditor v1.1.8-beta is affected by: XSS to code execution.

cpe:/a:gnome:evince:3.26.0

CVE-2019-1010006

2019-07-14T22:15:10.370-04:00

2019-07-16T18:15:12.667-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC http://bugzilla.maptools.org/show_bug.cgi?id=2745 SUSE openSUSE-SU-2019:1908 MISC https://bugzilla.gnome.org/show_bug.cgi?id=788980 MLIST [debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update MLIST [debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update UBUNTU USN-4067-1 Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.

cpe:/a:openenergymonitor:emoncms:9.8.8

CVE-2019-1010008

2019-07-14T22:15:10.433-04:00

2019-07-18T09:08:08.970-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T10:14:05.743-04:00

MISC https://github.com/emoncms/emoncms/issues/763 OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible.

cpe:/a:dglogik:dglux_server

CVE-2019-1010009

2019-07-14T23:15:10.193-04:00

2019-07-30T13:34:49.350-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T09:57:13.627-04:00

MISC https://gist.github.com/kaendfinger/3ad1dbeb62f902cc3ac2867f4e01ae38 DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The attack vector is: Any Accessible Server.

CVE-2019-1010011

2019-07-14T23:15:10.287-04:00

2019-07-16T16:15:11.420-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10753, CVE-2018-10771. Reason: This candidate is a reservation duplicate of CVE-2018-10753 and CVE-2018-10771. Notes: All CVE users should reference CVE-2018-10753 and CVE-2018-10771 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:dolibarr:dolibarr:6.0.4

CVE-2019-1010016

2019-07-14T23:15:10.397-04:00

2019-07-15T10:07:14.140-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T09:48:19.090-04:00

MISC https://github.com/Dolibarr/dolibarr/issues/7962 Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.

cpe:/a:libnmap:libnmap:0.2 cpe:/a:libnmap:libnmap:0.2.1 cpe:/a:libnmap:libnmap:0.2.2 cpe:/a:libnmap:libnmap:0.2.3 cpe:/a:libnmap:libnmap:0.2.4 cpe:/a:libnmap:libnmap:0.2.5 cpe:/a:libnmap:libnmap:0.2.6 cpe:/a:libnmap:libnmap:0.2.7 cpe:/a:libnmap:libnmap:0.2.8 cpe:/a:libnmap:libnmap:0.2.9 cpe:/a:libnmap:libnmap:0.4.1 cpe:/a:libnmap:libnmap:0.4.2 cpe:/a:libnmap:libnmap:0.4.5 cpe:/a:libnmap:libnmap:0.4.6 cpe:/a:libnmap:libnmap:0.5.1 cpe:/a:libnmap:libnmap:0.6 cpe:/a:libnmap:libnmap:0.6.1 cpe:/a:libnmap:libnmap:0.6.2

CVE-2019-1010017

2019-07-14T23:15:10.490-04:00

2019-07-17T14:55:01.707-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T09:45:39.003-04:00

MISC https://github.com/savon-noir/python-libnmap/issues/87 libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

cpe:/a:zammad:zammad:2.1.0 cpe:/a:zammad:zammad:2.1.1 cpe:/a:zammad:zammad:2.1.2 cpe:/a:zammad:zammad:2.2.0 cpe:/a:zammad:zammad:2.2.1 cpe:/a:zammad:zammad:2.3.0

CVE-2019-1010018

2019-07-16T09:15:10.893-04:00

2019-10-09T19:44:12.930-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://github.com/zammad/zammad/compare/5c983f6...1a9af7d MISC https://github.com/zammad/zammad/compare/ea50d0c...238784d MISC https://github.com/zammad/zammad/issues/1869 Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.

cpe:/a:gnu:glibc:-

CVE-2019-1010022

2019-07-15T00:15:13.317-04:00

2019-07-18T11:44:28.207-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T09:43:05.340-04:00

MISC https://sourceware.org/bugzilla/show_bug.cgi?id=22850 GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.

cpe:/a:gnu:glibc:-

CVE-2019-1010023

2019-07-15T00:15:13.397-04:00

2019-10-09T16:15:18.613-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 109167 MISC https://sourceware.org/bugzilla/show_bug.cgi?id=22851 CONFIRM https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.

cpe:/a:gnu:glibc:-

CVE-2019-1010024

2019-07-15T00:15:13.473-04:00

2019-09-20T03:15:10.657-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 109162 MISC https://sourceware.org/bugzilla/show_bug.cgi?id=22852 CONFIRM https://support.f5.com/csp/article/K06046097 CONFIRM https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc.

cpe:/a:gnu:glibc:-

CVE-2019-1010025

2019-07-15T00:15:13.537-04:00

2019-08-05T18:15:11.250-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://sourceware.org/bugzilla/show_bug.cgi?id=22853 CONFIRM https://support.f5.com/csp/article/K06046097 CONFIRM https://support.f5.com/csp/article/K06046097?utm_source=f5support&utm_medium=RSS ** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."

cpe:/a:school_college_portal_with_erp_script_project:school_college_portal_with_erp_script:2.6.1

CVE-2019-1010028

2019-07-15T00:15:13.617-04:00

2019-07-15T10:26:34.140-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T08:50:13.040-04:00

MISC https://whitehatck01.blogspot.com/2018/02/school-college-portal-with-erp-script.html phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />.

CVE-2019-1010030

2019-07-15T00:15:13.707-04:00

2019-07-15T01:15:10.643-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11501. Reason: This candidate is a reservation duplicate of CVE-2018-11501. Notes: All CVE users should reference CVE-2018-11501 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:deepsoft:weblibrarian:3.5.2::~~~wordpress~~

CVE-2019-1010034

2019-07-15T09:15:11.843-04:00

2019-08-21T14:15:13.023-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC https://plugins.trac.wordpress.org/browser/weblibrarian/trunk/includes/database_code.php MISC https://wpvulndb.com/vulnerabilities/9553 Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. This function call can be triggered by any user logged-in with at least Volunteer role or manage_circulation capabilities. PoC : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=DESC.

cpe:/a:openmodelica:omcompiler:1.9.2 cpe:/a:openmodelica:omcompiler:1.9.3:- cpe:/a:openmodelica:omcompiler:1.9.3:dev cpe:/a:openmodelica:omcompiler:1.9.3:dev.beta cpe:/a:openmodelica:omcompiler:1.9.3:dev.beta2 cpe:/a:openmodelica:omcompiler:1.9.4:- cpe:/a:openmodelica:omcompiler:1.9.4:dev cpe:/a:openmodelica:omcompiler:1.9.4:dev.beta1 cpe:/a:openmodelica:omcompiler:1.9.4:dev.beta2 cpe:/a:openmodelica:omcompiler:1.9.5:- cpe:/a:openmodelica:omcompiler:1.9.5:dev cpe:/a:openmodelica:omcompiler:1.9.6 cpe:/a:openmodelica:omcompiler:1.9.7 cpe:/a:openmodelica:omcompiler:1.10.0:dev cpe:/a:openmodelica:omcompiler:1.11.0:- cpe:/a:openmodelica:omcompiler:1.11.0:dev.beta1 cpe:/a:openmodelica:omcompiler:1.11.0:dev.beta2 cpe:/a:openmodelica:omcompiler:1.11.0:dev.beta3 cpe:/a:openmodelica:omcompiler:1.11.0:dev.beta4 cpe:/a:openmodelica:omcompiler:1.12.0:- cpe:/a:openmodelica:omcompiler:1.12.0:dev cpe:/a:openmodelica:omcompiler:1.12.0:dev.alpha1 cpe:/a:openmodelica:omcompiler:1.12.0:dev.beta1 cpe:/a:openmodelica:omcompiler:1.12.0:dev.beta2 cpe:/a:openmodelica:omcompiler:1.12.0:dev.beta3 cpe:/a:openmodelica:omcompiler:1.13.0 cpe:/a:openmodelica:omcompiler:1.13.0:- cpe:/a:openmodelica:omcompiler:1.13.0:dev cpe:/a:openmodelica:omcompiler:1.13.0:dev.01 cpe:/a:openmodelica:omcompiler:1.13.0:dev.beta1 cpe:/a:openmodelica:omcompiler:1.13.1 cpe:/a:openmodelica:omcompiler:1.13.2

CVE-2019-1010038

2019-07-15T09:15:11.907-04:00

2019-07-30T13:17:35.990-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T14:02:40.940-04:00

CONFIRM https://trac.openmodelica.org/OpenModelica/ticket/4787#trac-add-comment OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME parameter changeable via environment variable. The attack vector is: Changing an environment variable.

cpe:/a:ulaunchelf_project:ulaunchelf:170827a cpe:/a:ulaunchelf_project:ulaunchelf:190107

CVE-2019-1010039

2019-07-15T10:15:11.453-04:00

2019-07-16T10:12:46.570-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T13:50:32.830-04:00

MISC https://github.com/AKuHAK/uLaunchELF/issues/14 uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (loader.c) overly trusts the arguments provided via command line.

CVE-2019-1010042

2019-07-15T12:15:11.787-04:00

2019-07-16T15:15:12.940-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7662. Reason: This candidate is a reservation duplicate of CVE-2018-7662. Notes: All CVE users should reference CVE-2018-7662 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:quake3e_project:quake3e:-

CVE-2019-1010043

2019-07-16T10:15:11.733-04:00

2019-07-29T09:12:47.877-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T13:50:08.177-04:00

MISC https://github.com/ec-/Quake3e/issues/9 Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.

cpe:/a:archivesunleashed:graphpass:-

CVE-2019-1010044

2019-07-15T12:15:11.867-04:00

2019-07-17T14:22:58.823-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T14:27:54.853-04:00

MISC https://github.com/archivesunleashed/borg-reducer/issues/4 borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within the executable.

CVE-2019-1010048

2019-07-16T10:15:11.810-04:00

2019-07-17T10:15:11.427-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:dolibarr:dolibarr:7.0.0

CVE-2019-1010054

2019-07-18T09:15:11.063-04:00

2019-07-18T22:25:48.510-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T15:02:51.003-04:00

MISC https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.

cpe:/a:nfdump_project:nfdump:1.6.16

CVE-2019-1010057

2019-07-16T09:15:10.973-04:00

2019-08-23T23:15:10.060-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/phaag/nfdump/issues/104 FEDORA FEDORA-2019-0fbfb00cbb FEDORA FEDORA-2019-9013b5e75d nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The component is: nfx.c:546, nffile_inline.c:83, minilzo.c (redistributed). The attack vector is: nfdump must read and process a specially crafted file. The fixed version is: after commit 9f0fe9563366f62a71d34c92229da3432ec5cf0e.

cpe:/a:nasa:cfitsio:1.01 cpe:/a:nasa:cfitsio:1.02 cpe:/a:nasa:cfitsio:1.03 cpe:/a:nasa:cfitsio:1.04 cpe:/a:nasa:cfitsio:1.11 cpe:/a:nasa:cfitsio:1.20 cpe:/a:nasa:cfitsio:1.21 cpe:/a:nasa:cfitsio:1.22 cpe:/a:nasa:cfitsio:1.23 cpe:/a:nasa:cfitsio:1.24 cpe:/a:nasa:cfitsio:1.25 cpe:/a:nasa:cfitsio:1.30 cpe:/a:nasa:cfitsio:1.31 cpe:/a:nasa:cfitsio:1.32 cpe:/a:nasa:cfitsio:1.42 cpe:/a:nasa:cfitsio:1.101 cpe:/a:nasa:cfitsio:2.023 cpe:/a:nasa:cfitsio:2.024 cpe:/a:nasa:cfitsio:2.025 cpe:/a:nasa:cfitsio:2.026 cpe:/a:nasa:cfitsio:2.027 cpe:/a:nasa:cfitsio:2.028 cpe:/a:nasa:cfitsio:2.029 cpe:/a:nasa:cfitsio:2.030 cpe:/a:nasa:cfitsio:2.031 cpe:/a:nasa:cfitsio:2.032 cpe:/a:nasa:cfitsio:2.033 cpe:/a:nasa:cfitsio:2.034 cpe:/a:nasa:cfitsio:2.035 cpe:/a:nasa:cfitsio:2.036 cpe:/a:nasa:cfitsio:2.037 cpe:/a:nasa:cfitsio:2.100 cpe:/a:nasa:cfitsio:2.200 cpe:/a:nasa:cfitsio:2.201 cpe:/a:nasa:cfitsio:2.202 cpe:/a:nasa:cfitsio:2.203 cpe:/a:nasa:cfitsio:2.204 cpe:/a:nasa:cfitsio:2.300 cpe:/a:nasa:cfitsio:2.301 cpe:/a:nasa:cfitsio:2.400 cpe:/a:nasa:cfitsio:2.401 cpe:/a:nasa:cfitsio:2.410 cpe:/a:nasa:cfitsio:2.420 cpe:/a:nasa:cfitsio:2.430 cpe:/a:nasa:cfitsio:2.440 cpe:/a:nasa:cfitsio:2.450 cpe:/a:nasa:cfitsio:2.460 cpe:/a:nasa:cfitsio:2.470 cpe:/a:nasa:cfitsio:2.480 cpe:/a:nasa:cfitsio:2.490 cpe:/a:nasa:cfitsio:2.500 cpe:/a:nasa:cfitsio:2.510 cpe:/a:nasa:cfitsio:3.000 cpe:/a:nasa:cfitsio:3.01 cpe:/a:nasa:cfitsio:3.02 cpe:/a:nasa:cfitsio:3.03 cpe:/a:nasa:cfitsio:3.04 cpe:/a:nasa:cfitsio:3.05 cpe:/a:nasa:cfitsio:3.06 cpe:/a:nasa:cfitsio:3.07 cpe:/a:nasa:cfitsio:3.08 cpe:/a:nasa:cfitsio:3.09 cpe:/a:nasa:cfitsio:3.10 cpe:/a:nasa:cfitsio:3.11 cpe:/a:nasa:cfitsio:3.12 cpe:/a:nasa:cfitsio:3.13 cpe:/a:nasa:cfitsio:3.14 cpe:/a:nasa:cfitsio:3.18 cpe:/a:nasa:cfitsio:3.19 cpe:/a:nasa:cfitsio:3.20 cpe:/a:nasa:cfitsio:3.21 cpe:/a:nasa:cfitsio:3.22 cpe:/a:nasa:cfitsio:3.23 cpe:/a:nasa:cfitsio:3.24 cpe:/a:nasa:cfitsio:3.25 cpe:/a:nasa:cfitsio:3.26 cpe:/a:nasa:cfitsio:3.27 cpe:/a:nasa:cfitsio:3.28 cpe:/a:nasa:cfitsio:3.29 cpe:/a:nasa:cfitsio:3.30 cpe:/a:nasa:cfitsio:3.31 cpe:/a:nasa:cfitsio:3.32 cpe:/a:nasa:cfitsio:3.33 cpe:/a:nasa:cfitsio:3.34 cpe:/a:nasa:cfitsio:3.35 cpe:/a:nasa:cfitsio:3.36 cpe:/a:nasa:cfitsio:3.37 cpe:/a:nasa:cfitsio:3.38 cpe:/a:nasa:cfitsio:3.39 cpe:/a:nasa:cfitsio:3.40 cpe:/a:nasa:cfitsio:3.41 cpe:/a:nasa:cfitsio:3.42

CVE-2019-1010060

2019-07-16T09:15:11.033-04:00

2019-07-22T14:00:01.423-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-17T10:19:10.173-04:00

MISC https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=892458 MISC https://github.com/astropy/astropy/pull/7274 MISC https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3420.tar.gz MISC https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/cfitsio3430.tar.gz MISC https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/changes2.txt NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.

CVE-2019-1010061

2019-07-16T09:15:11.097-04:00

2019-07-16T15:15:13.080-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10364. Reason: This candidate is a reservation duplicate of CVE-2018-10364. Notes: All CVE users should reference CVE-2018-10364 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:pluck-cms:pluckcms:4.7.4

CVE-2019-1010062

2019-07-16T09:15:11.410-04:00

2019-10-09T19:44:13.773-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/pluck-cms/pluck/commit/09f0ab871bf633973cfd9fc4fe59d4a912397cf8 MISC https://github.com/pluck-cms/pluck/issues/44 PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.

cpe:/a:sleuthkit:the_sleuth_kit:4.6.0

CVE-2019-1010065

2019-07-18T13:15:11.507-04:00

2019-08-30T05:15:16.990-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/sleuthkit/sleuthkit/commit/114cd3d0aac8bd1aeaf4b33840feb0163d342d5b MISC https://issuetracker.google.com/issues/77809383 FEDORA FEDORA-2019-52f83932a1 FEDORA FEDORA-2019-2e68c0a0ee The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.

cpe:/a:llnl:model_specific_registers-safe:1.1.0

CVE-2019-1010066

2019-07-18T10:15:11.407-04:00

2019-07-25T09:26:57.970-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-18T23:46:21.543-04:00

MISC https://github.com/LLNL/msr-safe/compare/v1.1.0...v1.2.0 MISC https://www.tldp.org/LDP/lkmpg/2.4/html/x856.html Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking, in order to write to model specific registers, normally a function reserved for the root user. The fixed version is: v1.2.0.

cpe:/a:moinejf:abcm2ps:8.13.20

CVE-2019-1010069

2019-07-18T10:15:11.487-04:00

2019-07-19T15:54:11.390-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T23:42:37.783-04:00

MISC https://drive.google.com/drive/u/2/folders/1Y2IbtEr9v4l4Ruie_AY9BFJOHOGiDt7S MISC https://github.com/leesavide/abcm2ps/issues/18 moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.

CVE-2019-1010073

2019-07-18T10:15:11.563-04:00

2019-10-07T17:15:11.863-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10238. Reason: This issue was MERGED into CVE-2018-10238 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2018-10238 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:palletsprojects:flask:0.1 cpe:/a:palletsprojects:flask:0.2 cpe:/a:palletsprojects:flask:0.3 cpe:/a:palletsprojects:flask:0.3.1 cpe:/a:palletsprojects:flask:0.4 cpe:/a:palletsprojects:flask:0.5 cpe:/a:palletsprojects:flask:0.5.1 cpe:/a:palletsprojects:flask:0.5.2 cpe:/a:palletsprojects:flask:0.6 cpe:/a:palletsprojects:flask:0.6.1 cpe:/a:palletsprojects:flask:0.7 cpe:/a:palletsprojects:flask:0.7.1 cpe:/a:palletsprojects:flask:0.7.2 cpe:/a:palletsprojects:flask:0.8 cpe:/a:palletsprojects:flask:0.8.1 cpe:/a:palletsprojects:flask:0.9 cpe:/a:palletsprojects:flask:0.10 cpe:/a:palletsprojects:flask:0.10.1 cpe:/a:palletsprojects:flask:0.11 cpe:/a:palletsprojects:flask:0.11.1 cpe:/a:palletsprojects:flask:0.12 cpe:/a:palletsprojects:flask:0.12.1 cpe:/a:palletsprojects:flask:0.12.2 cpe:/a:palletsprojects:flask:0.12.3 cpe:/a:palletsprojects:flask:0.12.4

CVE-2019-1010083

2019-07-17T10:15:11.570-04:00

2019-08-25T12:15:10.830-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://www.palletsprojects.com/blog/flask-1-0-released/ The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.

cpe:/a:dancer%3a%3aplugin%3a%3asimplecrud_project:dancer%3a%3aplugin%3a%3asimplecrud:1.14

CVE-2019-1010084

2019-07-17T10:15:11.663-04:00

2019-07-23T13:22:35.110-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-17T13:31:02.040-04:00

MISC https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109 Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.

cpe:/a:tiny.cloud:tinymce:4.7.11 cpe:/a:tiny.cloud:tinymce:4.7.12

CVE-2019-1010091

2019-07-17T13:15:13.200-04:00

2019-10-09T19:44:14.273-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://github.com/tinymce/tinymce/issues/4394 tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.

cpe:/a:domainmod:domainmod:4.10.0

CVE-2019-1010094

2019-07-18T09:15:11.127-04:00

2019-07-18T23:31:44.470-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T14:39:53.487-04:00

MISC https://github.com/domainmod/domainmod/issues/65 domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.

cpe:/a:domainmod:domainmod:4.10.0

CVE-2019-1010095

2019-07-18T09:15:11.203-04:00

2019-07-18T23:30:02.327-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T14:39:23.080-04:00

MISC https://github.com/domainmod/domainmod/issues/65 domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: http://127.0.0.1/admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.

cpe:/a:domainmod:domainmod:4.10.0

CVE-2019-1010096

2019-07-18T09:15:11.250-04:00

2019-07-18T23:29:02.510-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T14:35:52.147-04:00

MISC https://github.com/domainmod/domainmod/issues/65 domainmod(https://domainmod.org/) domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.

cpe:/a:jetbrains:kotlin:0.9 cpe:/a:jetbrains:kotlin:1.2.70 cpe:/a:jetbrains:kotlin:1.3:- cpe:/a:jetbrains:kotlin:1.3:m2 cpe:/a:jetbrains:kotlin:1.3:rc cpe:/a:jetbrains:kotlin:1.3.20

CVE-2019-10101

2019-07-03T16:15:11.120-04:00

2019-07-20T14:15:10.323-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ MISC https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.

cpe:/a:akeo:rufus:3.0

CVE-2019-1010100

2019-07-19T12:15:12.040-04:00

2019-07-29T10:07:45.813-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T23:12:06.790-04:00

MISC http://seclists.org/oss-sec/2018/q2/146 Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables (ALL executables on the web site). The attack vector is: CAPEC-471, CWE-426, CWE-427.

cpe:/a:akeo:rufus:3.0

CVE-2019-1010101

2019-07-19T12:15:12.117-04:00

2019-07-29T10:05:36.293-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T23:12:34.557-04:00

MISC http://seclists.org/oss-sec/2018/q2/146 Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component is: Executable installer, portable executable (ALL executables available). The attack vector is: CWE-29, CWE-377, CWE-379.

cpe:/a:techytalk:quick_chat:4.14::~~~wordpress~~

CVE-2019-1010104

2019-07-18T12:15:11.890-04:00

2019-07-23T12:47:25.170-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T16:16:41.247-04:00

MISC https://metalamin.github.io/Quick-Chat-SQLi-EN/ TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.

cpe:/a:phpcoo:oecms:4.3.r60321

CVE-2019-1010112

2019-07-18T15:15:11.160-04:00

2019-07-22T14:11:25.983-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T09:40:39.853-04:00

MISC https://github.com/LiodAir/images/blob/master/csrf.md OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.

cpe:/a:premiumsoftware:cleditor:1.4.5

CVE-2019-1010113

2019-07-19T12:15:12.180-04:00

2019-07-25T15:19:47.863-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-19T23:16:55.723-04:00

MISC https://drive.google.com/drive/folders/1UxgdL8SJO6KKnG3bh0-LTl7C6i41VwoW?usp=sharing Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.

cpe:/a:modx:modx_revolution:2.6.4

CVE-2019-1010123

2019-07-23T09:15:12.943-04:00

2019-10-09T19:44:14.867-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://modx.pro/security/15912#comment-99640 MISC https://modx.today/posts/2018/07/critical-security-vulnerability-in-gallery-1.7.1 MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.

cpe:/a:webappick:woocommerce_product_feed:2.2.18::~~~wordpress~~

CVE-2019-1010124

2019-07-23T09:15:13.020-04:00

2019-08-30T11:15:10.753-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://104.207.151.48/woo-feed-manage-list.php MISC http://packetstormsecurity.com/files/154263/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html MISC https://wpvulndb.com/vulnerabilities/9856 MISC https://www.youtube.com/watch?v=T-sqQDFRRBg WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.

cpe:/a:vcftools_project:vcftools:0.1.13 cpe:/a:vcftools_project:vcftools:0.1.14

CVE-2019-1010127

2019-07-25T15:15:12.613-04:00

2019-07-30T10:15:14.530-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://docs.google.com/document/d/e/2PACX-1vQJveVcGMp_NMdBY5Je2K2k63RoCYznvKjJk5u1wJRmLotvwQkG5qiqZjpABcOkjzj49wkwGweiFwrc/pub CONFIRM https://github.com/vcftools/vcftools/issues/141 VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.

CVE-2019-1010129

2019-07-23T09:15:13.113-04:00

2019-07-29T18:15:12.003-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010127. Reason: This candidate is a reservation duplicate of CVE-2019-1010127. Notes: All CVE users should reference CVE-2019-1010127 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/o:chinamobileltd:gpn2.4p21-c-cn_firmware:w2001en-00

CVE-2019-1010136

2019-07-19T12:15:12.243-04:00

2019-07-24T16:35:21.183-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-22T14:04:02.120-04:00

EXPLOIT-DB Exploit Database MISC https://www.shodan.io/search?query=title%3APLC++pstVal-%3Evalue%3Ahtml%2Findex.html ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulnerable to an unauthenticated remote reboot due. The component is: Reboot settings are available to unauthenticated users instead of only authenticaed users. The attack vector is: Remote.

cpe:/a:scapy:scapy:2.4.0

CVE-2019-1010142

2019-07-19T12:15:12.320-04:00

2019-07-23T06:15:10.123-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 106674 MISC https://github.com/secdev/scapy/pull/1409 MISC https://github.com/secdev/scapy/pull/1409/files#diff-441eff981e466959968111fc6314fe93L1058 FEDORA FEDORA-2019-47946eb312 MISC https://www.imperva.com/blog/scapy-sploit-python-network-tool-is-vulnerable-to-denial-of-service-dos-attack-cve-pending/ scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.

cpe:/a:bmc:remedy_smart_reporting:-

CVE-2019-1010147

2019-07-25T20:15:11.073-04:00

2019-08-05T09:26:44.980-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-26T13:43:25.970-04:00

MISC https://drive.google.com/open?id=1sk5IklziyEggeWpWE4Wyk9xqa30CjNpS Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.

cpe:/a:zzcms:zzcms:8.3

CVE-2019-1010148

2019-07-23T10:15:12.153-04:00

2019-07-24T08:48:00.383-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T10:40:54.193-04:00

MISC https://gist.github.com/Lz1y/acd1bfd0cc0e0f53b8f781840e7bf368 zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.

cpe:/a:zzcms:zzcms:8.3

CVE-2019-1010149

2019-07-23T10:15:12.280-04:00

2019-07-26T09:35:14.557-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T12:10:59.897-04:00

MISC https://gist.github.com/Lz1y/e82eb9cc776e629b9d1874dc689421eb zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.

cpe:/a:zzcms:zzcms:8.3

CVE-2019-1010150

2019-07-23T10:15:12.357-04:00

2019-07-26T09:33:13.143-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T12:10:37.737-04:00

MISC https://gist.github.com/Lz1y/7ab529230c43dfc5441ac32dd13e3e5b zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.

cpe:/a:zzcms:zzmcms:8.3

CVE-2019-1010151

2019-07-19T10:15:12.233-04:00

2019-07-29T10:52:45.280-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T22:09:41.667-04:00

MISC https://gist.github.com/Lz1y/24a6368c7ffdc1af7292035dd16a97f5 zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.

cpe:/a:zzcms:zzcms:8.3

CVE-2019-1010152

2019-07-23T10:15:12.420-04:00

2019-07-24T08:56:23.347-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T12:09:10.510-04:00

MISC https://gist.github.com/Lz1y/cfb2f8179003b91404ad029333508f4c zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.

cpe:/a:zzcms:zzcms:8.3

CVE-2019-1010153

2019-07-23T10:15:12.547-04:00

2019-07-24T08:51:24.410-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T10:42:45.217-04:00

MISC https://gist.github.com/Lz1y/31595b060cd6a031896fdf2b3a1273f5 zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.

cpe:/o:dlink:dsl-2750u_firmware:1.11

CVE-2019-1010155

2019-07-23T10:15:12.623-04:00

2019-08-08T11:15:11.877-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov BID 109351 MISC https://cxsecurity.com/issue/WLB-2018080199 MISC https://www.youtube.com/watch?v=7sk6agpcA_s MISC https://youtu.be/BQQbp2vn_wY ** DISPUTED ** D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage.

CVE-2019-1010156

2019-07-23T10:15:12.687-04:00

2019-07-29T11:15:11.687-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010155. Reason: This candidate is a duplicate of CVE-2019-1010155. Notes: All CVE users should reference CVE-2019-1010155 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:perl-crypt-jwt_project:perl-crypt-jwt:0.022

CVE-2019-1010161

2019-07-25T10:15:11.453-04:00

2019-08-02T10:01:37.407-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-26T12:21:14.383-04:00

MISC https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483 perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.

cpe:/a:jsish:jsish:2.4.77_2.0477

CVE-2019-1010162

2019-07-23T10:15:12.747-04:00

2019-10-09T19:44:15.603-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://jsish.org/fossil/jsi/tktview/5533c4d665b9683eebe4d662493f15eb911d1c8f jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:121). The attack vector is: The victim must execute crafted javascript code. The fixed version is: 2.4.77.

cpe:/a:socusoft:photo_2_video_converter:8.0.0::~~free~~~ cpe:/a:socusoft:photo_2_video_converter:8.0.0::~~professional~~~

CVE-2019-1010163

2019-07-24T08:15:10.987-04:00

2019-08-01T14:44:13.500-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-25T13:11:14.540-04:00

MISC https://packetstormsecurity.com/files/145181/SocuSoft-Co.-Photo-2-Video-Converter-8.0.0-Code-Execution-DoS.html MISC https://ret2eax.github.io/posts/socusoft-bof.html EXPLOIT-DB Exploit Database Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege escalation (dependant upon conditions), shell code execution and denial-of-service. The component is: pdmlog.dll library. The attack vector is: The attacker must have access to local system (either directly, or remotley).

cpe:/a:jsish:jsish:2.4.77_2.0477

CVE-2019-1010169

2019-07-23T10:15:12.827-04:00

2019-07-23T15:24:39.613-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T14:34:14.857-04:00

MISC https://jsish.org/fossil/jsi/tktview/3a069014976f3422d9d96821dc555c8326c02ae3 Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.

cpe:/a:jsish:jsish:2.4.77_2.0477

CVE-2019-1010170

2019-07-23T10:15:12.903-04:00

2019-07-23T15:25:08.630-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T14:30:08.343-04:00

CONFIRM https://jsish.org/fossil/jsi/tktview/870f496bb8a707491df8026e2ff78b33a5cf44c1 Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.

cpe:/a:jsish:jsish:2.4.83_2.0483

CVE-2019-1010171

2019-07-23T10:15:12.997-04:00

2019-07-23T15:19:43.993-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T14:35:17.580-04:00

CONFIRM https://jsish.org/fossil/jsi/tktview/a3026a7c06e0f41af461aa0bc2f7a7e886209390 Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: function jsi_DumpFunctions (jsiEval.c:567). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.84.

cpe:/a:jsish:jsish:2.4.84_2.0484

CVE-2019-1010172

2019-07-25T10:15:11.517-04:00

2019-08-01T10:54:36.897-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T12:44:19.090-04:00

MISC https://jsish.org/fossil/jsi/tktview/16f01b0177c2e309ab01102feb76b39d57a3eb66 Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils.c). The attack vector is: executing crafted javascript code. The fixed version is: after commit f3a8096e0ce44bbf36c1dcb6e603adf9c8670c39.

cpe:/a:jsish:jsish:2.4.84_2.0484

CVE-2019-1010173

2019-07-23T11:15:10.960-04:00

2019-07-23T15:01:42.660-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T14:37:31.713-04:00

CONFIRM https://jsish.org/fossil/jsi/tktview/b3278d1a441477d50363d28df79bbf58de2448af Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 738ead193aff380a7e3d7ffb8e11e446f76867f3.

cpe:/a:cimg:the_cimg_library:2.3.3

CVE-2019-1010174

2019-07-25T10:15:11.560-04:00

2019-09-28T10:15:17.857-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://framagit.org/dtschump/CImg/commit/5ce7a426b77f814973e56182a0e76a2b04904146 MLIST [debian-lts-announce] 20190928 [SECURITY] [DLA 1934-1] cimg security update CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.

cpe:/a:jerryscript:jerryscript:- cpe:/a:jerryscript:jerryscript:1.0:- cpe:/a:jerryscript:jerryscript:1.0:rc1 cpe:/a:jerryscript:jerryscript:1.0:rc2

CVE-2019-1010176

2019-07-25T10:15:11.623-04:00

2019-08-05T09:19:02.240-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-26T11:16:33.317-04:00

MISC https://github.com/jerryscript-project/jerryscript/issues/2476 JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function lit_char_to_utf8_bytes (jerry-core/lit/lit-char-helpers.c:377). The attack vector is: executing crafted javascript code. The fixed version is: after commit 505dace719aebb3308a3af223cfaa985159efae0.

cpe:/a:jsish:jsish:2.4.70_2.047

CVE-2019-1010177

2019-07-24T08:15:11.080-04:00

2019-08-01T11:45:19.173-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T12:43:09.323-04:00

CONFIRM https://jsish.org/fossil/jsi/tktview?name=65c8965977 Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fixed version is: after commit 48a66c798d.

cpe:/a:modx:fred:1.0.0:-:~~~modx~~ cpe:/a:modx:fred:1.0.0:beta2:~~~modx~~ cpe:/a:modx:fred:1.0.0:beta4:~~~modx~~ cpe:/a:modx:fred:1.0.0:pl:~~~modx~~ cpe:/a:modx:fred:1.0.0:rc:~~~modx~~ cpe:/a:modx:fred:1.0.0:rc1:~~~modx~~ cpe:/a:modx:fred:1.0.0:rc2:~~~modx~~

CVE-2019-1010178

2019-07-24T10:15:10.877-04:00

2019-10-09T19:44:15.993-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://www.youtube.com/watch?v=vOlw2DP9WbE Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246.

cpe:/a:phkp_project:phkp:-

CVE-2019-1010179

2019-07-24T10:15:10.923-04:00

2019-08-01T11:19:16.150-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T11:47:58.627-04:00

MISC https://github.com/remko/phkp/issues/1 PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The component is: function pgp_exec() phkp.php:98. The attack vector is: HKP-Api: /pks/lookup?search.

cpe:/a:gnu:gdb

CVE-2019-1010180

2019-07-24T09:15:10.997-04:00

2019-08-01T11:39:30.940-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T12:36:29.197-04:00

BID 109367 MISC https://sourceware.org/bugzilla/show_bug.cgi?id=23657 GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.

cpe:/a:yaml-rust_project:yaml-rust:0.4.0

CVE-2019-1010182

2019-07-25T10:15:11.670-04:00

2019-08-05T11:24:47.130-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-26T10:57:58.733-04:00

MISC https://github.com/chyh1990/yaml-rust/pull/109 yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.

cpe:/a:serde-yaml_project:serde-yaml:0.6.0:- cpe:/a:serde-yaml_project:serde-yaml:0.6.0:rc1 cpe:/a:serde-yaml_project:serde-yaml:0.6.1 cpe:/a:serde-yaml_project:serde-yaml:0.6.2 cpe:/a:serde-yaml_project:serde-yaml:0.7.0 cpe:/a:serde-yaml_project:serde-yaml:0.7.1 cpe:/a:serde-yaml_project:serde-yaml:0.7.2 cpe:/a:serde-yaml_project:serde-yaml:0.7.3 cpe:/a:serde-yaml_project:serde-yaml:0.7.4 cpe:/a:serde-yaml_project:serde-yaml:0.7.5 cpe:/a:serde-yaml_project:serde-yaml:0.8.0 cpe:/a:serde-yaml_project:serde-yaml:0.8.1 cpe:/a:serde-yaml_project:serde-yaml:0.8.2 cpe:/a:serde-yaml_project:serde-yaml:0.8.3

CVE-2019-1010183

2019-07-25T09:15:11.593-04:00

2019-08-01T14:26:26.880-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-26T12:35:03.000-04:00

MISC https://github.com/dtolnay/serde-yaml/pull/105 serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.

CVE-2019-1010189

2019-07-24T10:15:10.987-04:00

2019-08-19T00:15:12.563-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2019-732b5488c2 MISC https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/ mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1.

CVE-2019-1010190

2019-07-24T09:15:11.073-04:00

2019-07-29T10:55:29.347-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T12:07:54.817-04:00

MISC https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/ mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local, the victim must open a specially crafted file. The fixed version is: 1.2.1.

cpe:/a:marginalia_project:marginalia:1.0.0 cpe:/a:marginalia_project:marginalia:1.0.1 cpe:/a:marginalia_project:marginalia:1.0.2 cpe:/a:marginalia_project:marginalia:1.0.3 cpe:/a:marginalia_project:marginalia:1.1.0 cpe:/a:marginalia_project:marginalia:1.1.1 cpe:/a:marginalia_project:marginalia:1.1.2 cpe:/a:marginalia_project:marginalia:1.1.3 cpe:/a:marginalia_project:marginalia:1.1.4 cpe:/a:marginalia_project:marginalia:1.1.5 cpe:/a:marginalia_project:marginalia:1.2.0 cpe:/a:marginalia_project:marginalia:1.3.0 cpe:/a:marginalia_project:marginalia:1.4.0 cpe:/a:marginalia_project:marginalia:1.5.0

CVE-2019-1010191

2019-07-24T10:15:11.033-04:00

2019-07-29T16:10:32.357-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-29T08:27:03.227-04:00

MISC https://github.com/basecamp/marginalia/pull/73/ marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.

cpe:/a:hisiphp:hisiphp:1.0.8

CVE-2019-1010193

2019-07-24T09:15:11.167-04:00

2019-07-26T16:46:18.047-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-25T09:26:41.750-04:00

MISC https://github.com/hisiphp/hisiphp/issues/3 hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).

cpe:/a:servicestack:servicestack:4.5.14

CVE-2019-1010199

2019-07-23T14:15:14.313-04:00

2019-07-25T15:19:14.330-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T08:30:54.213-04:00

MISC https://github.com/ServiceStack/ServiceStack/commit/a0e0d7de20f5d1712f1793f925496def4383c610 ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.

cpe:/a:jetbrains:kotlin:0.9 cpe:/a:jetbrains:kotlin:1.2.70 cpe:/a:jetbrains:kotlin:1.3:- cpe:/a:jetbrains:kotlin:1.3:m2 cpe:/a:jetbrains:kotlin:1.3:rc cpe:/a:jetbrains:kotlin:1.3.20 cpe:/a:jetbrains:ktor:0.0.1 cpe:/a:jetbrains:ktor:0.0.2 cpe:/a:jetbrains:ktor:0.0.3 cpe:/a:jetbrains:ktor:0.0.4 cpe:/a:jetbrains:ktor:0.0.5 cpe:/a:jetbrains:ktor:0.1.0 cpe:/a:jetbrains:ktor:0.1.2 cpe:/a:jetbrains:ktor:0.1.3 cpe:/a:jetbrains:ktor:0.1.4 cpe:/a:jetbrains:ktor:0.1.5 cpe:/a:jetbrains:ktor:0.1.6 cpe:/a:jetbrains:ktor:0.1.7 cpe:/a:jetbrains:ktor:0.1.8 cpe:/a:jetbrains:ktor:0.2.0 cpe:/a:jetbrains:ktor:0.2.1 cpe:/a:jetbrains:ktor:0.2.2 cpe:/a:jetbrains:ktor:0.2.3 cpe:/a:jetbrains:ktor:0.2.4 cpe:/a:jetbrains:ktor:0.3.0 cpe:/a:jetbrains:ktor:0.3.1 cpe:/a:jetbrains:ktor:0.3.2 cpe:/a:jetbrains:ktor:0.3.3 cpe:/a:jetbrains:ktor:0.3.4 cpe:/a:jetbrains:ktor:0.4.0:- cpe:/a:jetbrains:ktor:0.4.0:alpha10 cpe:/a:jetbrains:ktor:0.4.0:alpha11 cpe:/a:jetbrains:ktor:0.4.0:alpha12 cpe:/a:jetbrains:ktor:0.4.0:alpha13 cpe:/a:jetbrains:ktor:0.4.0:alpha14 cpe:/a:jetbrains:ktor:0.4.0:alpha15 cpe:/a:jetbrains:ktor:0.4.0:alpha6 cpe:/a:jetbrains:ktor:0.4.0:alpha7 cpe:/a:jetbrains:ktor:0.4.0:alpha8 cpe:/a:jetbrains:ktor:0.4.0:alpha9 cpe:/a:jetbrains:ktor:0.4.1:alpha16 cpe:/a:jetbrains:ktor:0.9.0:- cpe:/a:jetbrains:ktor:0.9.0:alpha1 cpe:/a:jetbrains:ktor:0.9.0:alpha2 cpe:/a:jetbrains:ktor:0.9.0:alpha3 cpe:/a:jetbrains:ktor:0.9.1:- cpe:/a:jetbrains:ktor:0.9.1:alpha10 cpe:/a:jetbrains:ktor:0.9.1:alpha4 cpe:/a:jetbrains:ktor:0.9.1:alpha5 cpe:/a:jetbrains:ktor:0.9.1:alpha6 cpe:/a:jetbrains:ktor:0.9.1:alpha7 cpe:/a:jetbrains:ktor:0.9.1:alpha8 cpe:/a:jetbrains:ktor:0.9.1:alpha9 cpe:/a:jetbrains:ktor:0.9.2:- cpe:/a:jetbrains:ktor:0.9.2:alpha1 cpe:/a:jetbrains:ktor:0.9.2:alpha2 cpe:/a:jetbrains:ktor:0.9.2:alpha3 cpe:/a:jetbrains:ktor:0.9.2:alpha4 cpe:/a:jetbrains:ktor:0.9.2:alpha5 cpe:/a:jetbrains:ktor:0.9.2:alpha6 cpe:/a:jetbrains:ktor:0.9.3:- cpe:/a:jetbrains:ktor:0.9.3:alpha1 cpe:/a:jetbrains:ktor:0.9.3:alpha2 cpe:/a:jetbrains:ktor:0.9.3:alpha3 cpe:/a:jetbrains:ktor:0.9.3:alpha4 cpe:/a:jetbrains:ktor:0.9.3:alpha5 cpe:/a:jetbrains:ktor:0.9.4:- cpe:/a:jetbrains:ktor:0.9.4:alpha2 cpe:/a:jetbrains:ktor:0.9.4:dev3 cpe:/a:jetbrains:ktor:0.9.5 cpe:/a:jetbrains:ktor:0.9.5:rc13 cpe:/a:jetbrains:ktor:1.0.0 cpe:/a:jetbrains:ktor:1.0.0:alpha1 cpe:/a:jetbrains:ktor:1.0.0:alpha2 cpe:/a:jetbrains:ktor:1.0.0:alpha3 cpe:/a:jetbrains:ktor:1.0.0:beta1 cpe:/a:jetbrains:ktor:1.0.0:beta2 cpe:/a:jetbrains:ktor:1.0.0:beta3 cpe:/a:jetbrains:ktor:1.0.0:beta4 cpe:/a:jetbrains:ktor:1.0.0:rc cpe:/a:jetbrains:ktor:1.0.1

CVE-2019-10102

2019-07-03T16:15:11.167-04:00

2019-07-12T09:40:08.503-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-08T11:34:29.353-04:00

MISC https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.

cpe:/a:google:voice_builder:-

CVE-2019-1010200

2019-07-23T14:15:14.377-04:00

2019-10-09T19:44:16.523-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC https://github.com/google/voice-builder/commit/c145d4604df67e6fc625992412eef0bf9a85e26b MISC https://github.com/google/voice-builder/commit/f6660e6d8f0d1d931359d591dbdec580fef36d36 Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The impact is: Remote code execution with the same privileges as the servers. The component is: Two web servers in the projects expose three vulnerable endpoints that can be accessed remotely. The endpoints are defined at: - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/merlin_model_server/api.js#L34 - /alignment: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L28 - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#L65. The attack vector is: Attacker sends a GET request to the vulnerable endpoint with a specially formatted query parameter. The fixed version is: After commit f6660e6d8f0d1d931359d591dbdec580fef36d36.

cpe:/a:jeesite:jeesite:1.2.7

CVE-2019-1010201

2019-07-23T14:15:14.457-04:00

2019-07-24T11:17:29.377-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T07:30:28.550-04:00

MISC https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/dao/ActDao.java Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/main/java/com.thinkgem.jeesite/modules/act/ActDao.java has SQL Injection vulnerability. The attack vector is: network connectivity,authenticated. The fixed version is: 4.0 and later.

cpe:/a:jeesite:jeesite:1.2.7

CVE-2019-1010202

2019-07-23T10:15:13.060-04:00

2019-08-05T09:57:27.033-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-23T14:15:02.033-04:00

MISC https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/service/ActProcessService.java Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.

cpe:/a:gnu:binutils:2.21.1 cpe:/a:gnu:binutils:2.21.1a cpe:/a:gnu:binutils:2.22 cpe:/a:gnu:binutils:2.23 cpe:/a:gnu:binutils:2.23.1 cpe:/a:gnu:binutils:2.23.2 cpe:/a:gnu:binutils:2.24 cpe:/a:gnu:binutils:2.25 cpe:/a:gnu:binutils:2.25.1 cpe:/a:gnu:binutils:2.26 cpe:/a:gnu:binutils:2.26.1 cpe:/a:gnu:binutils:2.27 cpe:/a:gnu:binutils:2.28 cpe:/a:gnu:binutils:2.28.1 cpe:/a:gnu:binutils:2.29 cpe:/a:gnu:binutils:2.29.1 cpe:/a:gnu:binutils:2.30 cpe:/a:gnu:binutils:2.31 cpe:/a:gnu:binutils:2.31.1

CVE-2019-1010204

2019-07-23T10:15:13.373-04:00

2019-08-22T03:15:10.673-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://security.netapp.com/advisory/ntap-20190822-0001/ MISC https://sourceware.org/bugzilla/show_bug.cgi?id=23765 GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.

cpe:/a:linagora:hublin:-

CVE-2019-1010205

2019-07-23T10:15:13.437-04:00

2019-07-26T13:12:03.130-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T12:17:21.977-04:00

MISC https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1 LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file (with a fixed extension) on the server. The component is: A web-view renderer; details here: https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1. The attack vector is: Attacker sends a specially crafted HTTP request.

cpe:/a:http-request_project:http_request:6::~~~cordova~~

CVE-2019-1010206

2019-07-23T10:15:13.513-04:00

2019-08-01T13:00:17.820-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T11:47:52.633-04:00

MISC https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

cpe:/a:genetechsolutions:pie_register:3.0.15::~~~wordpress~~

CVE-2019-1010207

2019-07-23T10:15:13.593-04:00

2019-07-29T14:55:27.210-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T10:49:38.520-04:00

MISC https://0day.today/exploit/31255 MISC https://packetstormsecurity.com/files/149665/wppieregister3015-xss.txt MISC https://seclists.org/bugtraq/2018/Oct/16 Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/her account. The fixed version is: 3.0.16.

cpe:/a:idrix:truecrypt cpe:/a:idrix:veracrypt:1.23

CVE-2019-1010208

2019-07-23T10:15:13.653-04:00

2019-08-05T11:38:45.683-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-24T10:36:23.263-04:00

MISC https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor information disclosure of kernel stack. The component is: Veracrypt NT Driver (veracrypt.sys). The attack vector is: Locally executed code, IOCTL request to driver. The fixed version is: 1.23-Hotfix-1.

cpe:/a:gorul:gourl:1.4.13::~~~wordpress~~

CVE-2019-1010209

2019-07-23T10:15:13.747-04:00

2019-10-09T19:44:16.883-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af MISC https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637 MISC https://www.youtube.com/watch?v=K2HElM_ZYu4 GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.

cpe:/a:cherokee-project:cherokee_web_server:1.2.103

CVE-2019-1010218

2019-07-22T14:15:10.917-04:00

2019-10-09T19:44:17.133-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://i.imgur.com/PWCCyir.png Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version is: There's no fix yet.

cpe:/a:tcpdump:tcpdump:4.9.2

CVE-2019-1010220

2019-07-22T14:15:11.027-04:00

2019-08-20T14:15:11.017-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2019:1964 MISC https://github.com/the-tcpdump-group/tcpdump/blob/master/print-hncp.c MISC https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9.2/print-hncp.c MISC https://github.com/the-tcpdump-group/tcpdump/commits/master/print-hncp.c tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is: The victim must open a specially crafted pcap file.

cpe:/o:lineageos:lineageos:16.0

CVE-2019-1010221

2019-07-23T10:15:13.827-04:00

2019-08-02T14:38:43.150-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-23T14:00:15.947-04:00

MISC https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7 LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.

CVE-2019-1010222

2019-07-22T14:15:11.103-04:00

2019-07-26T09:15:11.863-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19801. Reason: This candidate is a reservation duplicate of CVE-2018-19801. Notes: All CVE users should reference CVE-2018-19801 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1010223

2019-07-22T14:15:11.197-04:00

2019-07-26T09:15:12.033-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19800. Reason: This candidate is a reservation duplicate of CVE-2018-19800. Notes: All CVE users should reference CVE-2018-19800 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1010224

2019-07-22T14:15:11.277-04:00

2019-07-26T09:15:12.237-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19802. Reason: This candidate is a reservation duplicate of CVE-2018-19802. Notes: All CVE users should reference CVE-2018-19802 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:offis:dcmtk:3.6.3

CVE-2019-1010228

2019-07-22T13:15:38.793-04:00

2019-09-26T23:15:13.913-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2019-4349fc0afb FEDORA FEDORA-2019-12650a34d8 MISC https://support.dcmtk.org/redmine/issues/858 OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.

cpe:/a:juniper:libslax:0.22.0

CVE-2019-1010232

2019-07-22T12:15:11.253-04:00

2019-08-01T12:43:00.803-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-24T12:55:51.737-04:00

MISC https://bugzilla.redhat.com/show_bug.cgi?id=1649175 Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc --slax-to-xslt POC0.

cpe:/o:linuxfoundation:open_network_operating_system:1.15.0

CVE-2019-1010234

2019-07-22T11:15:10.393-04:00

2019-07-25T12:52:51.647-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-25T12:20:22.183-04:00

MISC https://drive.google.com/file/d/1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv/view?usp=sharing The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.

cpe:/a:frog_cms_project:frog_cms:1.1

CVE-2019-1010235

2019-07-22T11:15:10.457-04:00

2019-07-23T08:04:11.877-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-22T13:27:32.903-04:00

MISC https://somerandomshitwbu.blogspot.com/2019/01/stored-xss-in-frog-cms-open-source.html Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.

cpe:/a:ilias:ilias:5.2.0 cpe:/a:ilias:ilias:5.2.0:beta1 cpe:/a:ilias:ilias:5.2.0:beta2 cpe:/a:ilias:ilias:5.2.0:beta3 cpe:/a:ilias:ilias:5.2.1 cpe:/a:ilias:ilias:5.2.2 cpe:/a:ilias:ilias:5.2.3 cpe:/a:ilias:ilias:5.2.4 cpe:/a:ilias:ilias:5.2.5 cpe:/a:ilias:ilias:5.2.6 cpe:/a:ilias:ilias:5.2.7 cpe:/a:ilias:ilias:5.2.8 cpe:/a:ilias:ilias:5.2.9 cpe:/a:ilias:ilias:5.2.10 cpe:/a:ilias:ilias:5.2.11 cpe:/a:ilias:ilias:5.2.12 cpe:/a:ilias:ilias:5.2.13 cpe:/a:ilias:ilias:5.2.14 cpe:/a:ilias:ilias:5.2.15 cpe:/a:ilias:ilias:5.2.16 cpe:/a:ilias:ilias:5.2.18 cpe:/a:ilias:ilias:5.2.19 cpe:/a:ilias:ilias:5.2.20 cpe:/a:ilias:ilias:5.3.0 cpe:/a:ilias:ilias:5.3.0:beta1 cpe:/a:ilias:ilias:5.3.0:beta2 cpe:/a:ilias:ilias:5.3.0:beta3 cpe:/a:ilias:ilias:5.3.0:beta4 cpe:/a:ilias:ilias:5.3.1 cpe:/a:ilias:ilias:5.3.2 cpe:/a:ilias:ilias:5.3.3 cpe:/a:ilias:ilias:5.3.4 cpe:/a:ilias:ilias:5.3.5 cpe:/a:ilias:ilias:5.3.8 cpe:/a:ilias:ilias:5.3.9 cpe:/a:ilias:ilias:5.3.10 cpe:/a:ilias:ilias:5.3.11

CVE-2019-1010237

2019-07-22T11:15:10.517-04:00

2019-10-09T19:44:17.697-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://docu.ilias.de/goto_docu_pg_116867_35.html MISC https://github.com/ILIAS-eLearning/ILIAS/commit/b9150b7194f8cfb1178ca3674a0b3c86b7cd92f5 MISC https://github.com/ILIAS-eLearning/ILIAS/commit/f1c2f906410bf35bb6bd45efff57d2e8da3b3825 Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.

cpe:/a:pango:pango:1.42.0 cpe:/a:pango:pango:1.42.1 cpe:/a:pango:pango:1.42.2 cpe:/a:pango:pango:1.42.3 cpe:/a:pango:pango:1.42.4 cpe:/a:pango:pango:1.43.0

CVE-2019-1010238

2019-07-19T13:15:11.690-04:00

2019-07-31T16:15:11.223-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHBA-2019:2824 REDHAT RHSA-2019:2571 REDHAT RHSA-2019:2582 REDHAT RHSA-2019:2594 MISC https://gitlab.gnome.org/GNOME/pango/blob/master/pango/pango-bidi-type.c FEDORA FEDORA-2019-547be4a683 FEDORA FEDORA-2019-155e34df5a BUGTRAQ 20190812 [SECURITY] [DSA 4496-1] pango1.0 security update GENTOO GLSA-201909-03 UBUNTU USN-4081-1 DEBIAN DSA-4496 Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

cpe:/a:cjson_project:cjson:1.7.8

CVE-2019-1010239

2019-07-19T13:15:11.783-04:00

2019-07-29T09:45:00.157-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T23:02:10.373-04:00

MISC https://github.com/DaveGamble/cJSON/commit/be749d7efa7c9021da746e685bd6dec79f9dd99b MISC https://github.com/DaveGamble/cJSON/issues/315 DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.

cpe:/a:jenkins:credentials_binding:1.17::~~~jenkins~~

CVE-2019-1010241

2019-07-19T13:15:11.877-04:00

2019-07-26T04:15:10.900-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 109320 MISC https://docs.google.com/document/d/1MBEoJSMvkjp5Kua0bRD_kiDBisL0fOCwTL9uMWj4lGA/edit?usp=sharing Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.

cpe:/o:linuxfoundation:open_network_operating_system:1.15

CVE-2019-1010245

2019-07-19T11:15:11.987-04:00

2019-07-25T12:19:30.897-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T22:51:37.500-04:00

MISC https://drive.google.com/open?id=1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv MISC https://gerrit.onosproject.org/#/c/20767/ The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.

cpe:/a:mailcleaner:mailcleaner:2011.9::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2012.5::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2012.6::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2014.10::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2017.09::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2018.02::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2018.06::~~community~~~ cpe:/a:mailcleaner:mailcleaner:2018.08::~~community~~~

CVE-2019-1010246

2019-07-18T15:15:11.257-04:00

2019-07-29T13:39:02.733-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-23T13:52:29.473-04:00

MISC https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.

CVE-2019-1010247

2019-07-19T11:15:12.063-04:00

2019-08-23T19:15:10.603-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://github.com/zmartzone/mod_auth_openidc/commit/132a4111bf3791e76437619a66336dce2ce4c79b MISC https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.3.10.2 MLIST [debian-lts-announce] 20190823 [SECURITY] [DLA 1894-1] libapache2-mod-auth-openidc security MISC https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-001_mod_auth_openidc_reflected_xss.txt ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

cpe:/a:i-doit:i-doit:1.12

CVE-2019-1010248

2019-07-18T14:15:12.060-04:00

2019-07-23T15:29:20.080-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T11:09:19.547-04:00

MISC https://sourceforge.net/projects/i-doit/files/i-doit/1.12.1/CHANGELOG/download Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1.

cpe:/o:linuxfoundation:open_network_operating_system:2.0.0

CVE-2019-1010249

2019-07-18T14:15:12.137-04:00

2019-07-24T11:51:21.080-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T21:20:30.630-04:00

MISC https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD MISC https://drive.google.com/open?id=1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.

cpe:/o:linuxfoundation:open_network_operating_system:2.0.0

CVE-2019-1010250

2019-07-18T14:15:12.217-04:00

2019-07-25T10:49:29.967-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T21:17:13.527-04:00

MISC https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1 MISC https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.

cpe:/a:oisf:suricata:4.0.2 cpe:/a:oisf:suricata:4.0.3 cpe:/a:oisf:suricata:4.0.5 cpe:/a:oisf:suricata:4.1.0:beta1

CVE-2019-1010251

2019-07-18T14:15:12.293-04:00

2019-07-23T14:23:14.593-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T23:20:25.327-04:00

MISC https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe MISC https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b MISC https://redmine.openinfosecfoundation.org/issues/2736 Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.

cpe:/o:linuxfoundation:open_network_operating_system:2.0.0

CVE-2019-1010252

2019-07-18T14:15:12.373-04:00

2019-07-29T09:28:30.813-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-07-19T10:03:43.070-04:00

MISC https://drive.google.com/open?id=1ce1uqcJYI-sEENGbPmmw-uJTwCXTUyJn MISC https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.

CVE-2019-1010257

2019-03-27T15:30:11.663-04:00

2019-08-03T17:15:11.240-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html BUGTRAQ 20190326 [article2pdf (Wordpress plug-in)] Multiple vulnerabilities (CVE-2019-1000031, CVE-2019-1010257) MISC https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised/ MISC https://wpvulndb.com/vulnerabilities/9246 An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be constructed which allows overriding the PDF file's path leading to any PDF whose path is known and which is readable to the web server can be downloaded. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.

cpe:/a:nanosvg_project:nanosvg:-

CVE-2019-1010258

2019-05-15T14:29:00.263-04:00

2019-05-16T14:41:29.183-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-05-16T13:03:43.847-04:00

MISC https://0day.work/cve-2019-1000032-memory-corruption-in-nanosvg/ MISC https://github.com/memononen/nanosvg/ MISC https://github.com/memononen/nanosvg/issues/136 nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.

cpe:/a:saltstack:salt_2018:3.0 cpe:/a:saltstack:salt_2019:2.0

CVE-2019-1010259

2019-07-18T13:15:11.567-04:00

2019-08-13T14:15:12.150-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534 MISC https://github.com/saltstack/salt/pull/51462 MISC https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.

cpe:/a:ktlint_project:ktlint:0.1.0 cpe:/a:ktlint_project:ktlint:0.1.1 cpe:/a:ktlint_project:ktlint:0.1.2 cpe:/a:ktlint_project:ktlint:0.2.0 cpe:/a:ktlint_project:ktlint:0.2.1 cpe:/a:ktlint_project:ktlint:0.2.2 cpe:/a:ktlint_project:ktlint:0.3.0 cpe:/a:ktlint_project:ktlint:0.3.1 cpe:/a:ktlint_project:ktlint:0.4.0 cpe:/a:ktlint_project:ktlint:0.5.0 cpe:/a:ktlint_project:ktlint:0.5.1 cpe:/a:ktlint_project:ktlint:0.6.0 cpe:/a:ktlint_project:ktlint:0.6.1 cpe:/a:ktlint_project:ktlint:0.6.2 cpe:/a:ktlint_project:ktlint:0.7.0 cpe:/a:ktlint_project:ktlint:0.7.1 cpe:/a:ktlint_project:ktlint:0.8.0 cpe:/a:ktlint_project:ktlint:0.8.1 cpe:/a:ktlint_project:ktlint:0.8.2 cpe:/a:ktlint_project:ktlint:0.8.3 cpe:/a:ktlint_project:ktlint:0.9.0 cpe:/a:ktlint_project:ktlint:0.9.1 cpe:/a:ktlint_project:ktlint:0.9.2 cpe:/a:ktlint_project:ktlint:0.10.0 cpe:/a:ktlint_project:ktlint:0.10.1 cpe:/a:ktlint_project:ktlint:0.10.2 cpe:/a:ktlint_project:ktlint:0.11.0 cpe:/a:ktlint_project:ktlint:0.11.1 cpe:/a:ktlint_project:ktlint:0.12.0 cpe:/a:ktlint_project:ktlint:0.12.1 cpe:/a:ktlint_project:ktlint:0.13.0 cpe:/a:ktlint_project:ktlint:0.14.0 cpe:/a:ktlint_project:ktlint:0.15.0 cpe:/a:ktlint_project:ktlint:0.15.1 cpe:/a:ktlint_project:ktlint:0.16.0 cpe:/a:ktlint_project:ktlint:0.16.1 cpe:/a:ktlint_project:ktlint:0.17.0 cpe:/a:ktlint_project:ktlint:0.17.1 cpe:/a:ktlint_project:ktlint:0.18.0 cpe:/a:ktlint_project:ktlint:0.19.0 cpe:/a:ktlint_project:ktlint:0.20.0 cpe:/a:ktlint_project:ktlint:0.21.0 cpe:/a:ktlint_project:ktlint:0.22.0 cpe:/a:ktlint_project:ktlint:0.23.0 cpe:/a:ktlint_project:ktlint:0.23.1 cpe:/a:ktlint_project:ktlint:0.24.0 cpe:/a:ktlint_project:ktlint:0.25.0 cpe:/a:ktlint_project:ktlint:0.25.1 cpe:/a:ktlint_project:ktlint:0.26.0 cpe:/a:ktlint_project:ktlint:0.27.0 cpe:/a:ktlint_project:ktlint:0.28.0 cpe:/a:ktlint_project:ktlint:0.29.0

CVE-2019-1010260

2019-04-02T11:29:00.480-04:00

2019-04-04T11:09:48.793-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-04-03T14:05:23.457-04:00

MISC https://github.com/shyiko/ktlint/pull/332 Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.

cpe:/a:gitea:gitea:1.7.0

CVE-2019-1010261

2019-07-18T13:15:11.647-04:00

2019-07-19T15:42:30.703-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-18T21:52:59.967-04:00

MISC https://github.com/go-gitea/gitea/pull/5905 Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.

CVE-2019-1010262

2019-07-18T13:15:11.710-04:00

2019-07-20T22:15:11.197-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-1010142. Reason: This candidate is a reservation duplicate of CVE-2019-1010142. Notes: All CVE users should reference CVE-2019-1010142 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1010263

2019-07-17T17:15:10.780-04:00

2019-07-28T19:46:12.160-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T09:49:06.587-04:00

MISC https://github.com/DCIT/perl-Crypt-JWT/commit/b98a59b42ded9f9e51b2560410106207c2152d6c MISC https://www.openwall.com/lists/oss-security/2018/09/07/1 Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.

cpe:/a:lodash:lodash:0.1.0::~~~node.js~~ cpe:/a:lodash:lodash:0.2.0::~~~node.js~~ cpe:/a:lodash:lodash:0.2.1::~~~node.js~~ cpe:/a:lodash:lodash:0.2.2::~~~node.js~~ cpe:/a:lodash:lodash:0.3.0::~~~node.js~~ cpe:/a:lodash:lodash:0.3.1::~~~node.js~~ cpe:/a:lodash:lodash:0.3.2::~~~node.js~~ cpe:/a:lodash:lodash:0.4.0::~~~node.js~~ cpe:/a:lodash:lodash:0.4.1::~~~node.js~~ cpe:/a:lodash:lodash:0.4.2::~~~node.js~~ cpe:/a:lodash:lodash:0.5.0:-:~~~node.js~~ cpe:/a:lodash:lodash:0.5.0:rc1:~~~node.js~~ cpe:/a:lodash:lodash:0.5.1::~~~node.js~~ cpe:/a:lodash:lodash:0.5.2::~~~node.js~~ cpe:/a:lodash:lodash:0.6.0::~~~node.js~~ cpe:/a:lodash:lodash:0.6.1::~~~node.js~~ cpe:/a:lodash:lodash:0.7.0::~~~node.js~~ cpe:/a:lodash:lodash:0.8.0::~~~node.js~~ cpe:/a:lodash:lodash:0.8.1::~~~node.js~~ cpe:/a:lodash:lodash:0.8.2::~~~node.js~~ cpe:/a:lodash:lodash:0.9.0::~~~node.js~~ cpe:/a:lodash:lodash:0.9.1::~~~node.js~~ cpe:/a:lodash:lodash:0.9.2::~~~node.js~~ cpe:/a:lodash:lodash:0.10.0::~~~node.js~~ cpe:/a:lodash:lodash:1.0.0:-:~~~node.js~~ cpe:/a:lodash:lodash:1.0.0:rc1:~~~node.js~~ cpe:/a:lodash:lodash:1.0.0:rc2:~~~node.js~~ cpe:/a:lodash:lodash:1.0.0:rc3:~~~node.js~~ cpe:/a:lodash:lodash:1.0.1::~~~node.js~~ cpe:/a:lodash:lodash:1.0.2::~~~node.js~~ cpe:/a:lodash:lodash:1.1.0::~~~node.js~~ cpe:/a:lodash:lodash:1.1.1::~~~node.js~~ cpe:/a:lodash:lodash:1.2.0::~~~node.js~~ cpe:/a:lodash:lodash:1.2.1::~~~node.js~~ cpe:/a:lodash:lodash:1.3.0::~~~node.js~~ cpe:/a:lodash:lodash:1.3.1::~~~node.js~~ cpe:/a:lodash:lodash:2.0.0::~~~node.js~~ cpe:/a:lodash:lodash:2.1.0::~~~node.js~~ cpe:/a:lodash:lodash:2.2.0::~~~node.js~~ cpe:/a:lodash:lodash:2.2.1::~~~node.js~~ cpe:/a:lodash:lodash:2.3.0::~~~node.js~~ cpe:/a:lodash:lodash:2.4.0::~~~node.js~~ cpe:/a:lodash:lodash:2.4.1::~~~node.js~~ cpe:/a:lodash:lodash:2.4.2::~~~node.js~~ cpe:/a:lodash:lodash:3.0.0::~~~node.js~~ cpe:/a:lodash:lodash:3.0.1::~~~node.js~~ cpe:/a:lodash:lodash:3.1.0::~~~node.js~~ cpe:/a:lodash:lodash:3.2.0::~~~node.js~~ cpe:/a:lodash:lodash:3.3.0::~~~node.js~~ cpe:/a:lodash:lodash:3.3.1::~~~node.js~~ cpe:/a:lodash:lodash:3.4.0::~~~node.js~~ cpe:/a:lodash:lodash:3.5.0::~~~node.js~~ cpe:/a:lodash:lodash:3.6.0::~~~node.js~~ cpe:/a:lodash:lodash:3.7.0::~~~node.js~~ cpe:/a:lodash:lodash:3.8.0::~~~node.js~~ cpe:/a:lodash:lodash:3.9.0::~~~node.js~~ cpe:/a:lodash:lodash:3.9.1::~~~node.js~~ cpe:/a:lodash:lodash:3.9.2::~~~node.js~~ cpe:/a:lodash:lodash:3.9.3::~~~node.js~~ cpe:/a:lodash:lodash:3.10.0::~~~node.js~~ cpe:/a:lodash:lodash:3.10.1::~~~node.js~~ cpe:/a:lodash:lodash:4.0.0::~~~node.js~~ cpe:/a:lodash:lodash:4.0.1::~~~node.js~~ cpe:/a:lodash:lodash:4.1.0::~~~node.js~~ cpe:/a:lodash:lodash:4.2.0::~~~node.js~~ cpe:/a:lodash:lodash:4.2.1::~~~node.js~~ cpe:/a:lodash:lodash:4.3.0::~~~node.js~~ cpe:/a:lodash:lodash:4.4.0::~~~node.js~~ cpe:/a:lodash:lodash:4.5.0::~~~node.js~~ cpe:/a:lodash:lodash:4.5.1::~~~node.js~~ cpe:/a:lodash:lodash:4.6.0::~~~node.js~~ cpe:/a:lodash:lodash:4.6.1::~~~node.js~~ cpe:/a:lodash:lodash:4.7.0::~~~node.js~~ cpe:/a:lodash:lodash:4.8.0::~~~node.js~~ cpe:/a:lodash:lodash:4.8.1::~~~node.js~~ cpe:/a:lodash:lodash:4.8.2::~~~node.js~~ cpe:/a:lodash:lodash:4.9.0::~~~node.js~~ cpe:/a:lodash:lodash:4.10.0::~~~node.js~~ cpe:/a:lodash:lodash:4.11.0::~~~node.js~~ cpe:/a:lodash:lodash:4.11.1::~~~node.js~~ cpe:/a:lodash:lodash:4.11.2::~~~node.js~~ cpe:/a:lodash:lodash:4.12.0::~~~node.js~~ cpe:/a:lodash:lodash:4.13.0::~~~node.js~~ cpe:/a:lodash:lodash:4.13.1::~~~node.js~~ cpe:/a:lodash:lodash:4.14.0::~~~node.js~~ cpe:/a:lodash:lodash:4.14.1::~~~node.js~~ cpe:/a:lodash:lodash:4.14.2::~~~node.js~~ cpe:/a:lodash:lodash:4.15.0::~~~node.js~~ cpe:/a:lodash:lodash:4.16.0::~~~node.js~~ cpe:/a:lodash:lodash:4.16.1::~~~node.js~~ cpe:/a:lodash:lodash:4.16.2::~~~node.js~~ cpe:/a:lodash:lodash:4.16.3::~~~node.js~~ cpe:/a:lodash:lodash:4.16.4::~~~node.js~~ cpe:/a:lodash:lodash:4.16.5::~~~node.js~~ cpe:/a:lodash:lodash:4.16.6::~~~node.js~~ cpe:/a:lodash:lodash:4.17.0::~~~node.js~~ cpe:/a:lodash:lodash:4.17.1::~~~node.js~~ cpe:/a:lodash:lodash:4.17.2::~~~node.js~~ cpe:/a:lodash:lodash:4.17.3::~~~node.js~~ cpe:/a:lodash:lodash:4.17.4::~~~node.js~~ cpe:/a:lodash:lodash:4.17.5::~~~node.js~~ cpe:/a:lodash:lodash:4.17.9::~~~node.js~~ cpe:/a:lodash:lodash:4.17.10::~~~node.js~~

CVE-2019-1010266

2019-07-17T17:15:10.873-04:00

2019-09-19T13:15:11.017-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/lodash/lodash/issues/3359 CONFIRM https://github.com/lodash/lodash/wiki/Changelog CONFIRM https://security.netapp.com/advisory/ntap-20190919-0004/ MISC https://snyk.io/vuln/SNYK-JS-LODASH-73639 lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

cpe:/a:ladon_project:ladon:0.6.1 cpe:/a:ladon_project:ladon:0.6.2 cpe:/a:ladon_project:ladon:0.6.3 cpe:/a:ladon_project:ladon:0.6.4 cpe:/a:ladon_project:ladon:0.6.5 cpe:/a:ladon_project:ladon:0.6.6 cpe:/a:ladon_project:ladon:0.6.7 cpe:/a:ladon_project:ladon:0.7.0 cpe:/a:ladon_project:ladon:0.7.1 cpe:/a:ladon_project:ladon:0.7.2 cpe:/a:ladon_project:ladon:0.7.3 cpe:/a:ladon_project:ladon:0.7.6 cpe:/a:ladon_project:ladon:0.7.7 cpe:/a:ladon_project:ladon:0.7.9 cpe:/a:ladon_project:ladon:0.8.0 cpe:/a:ladon_project:ladon:0.8.1 cpe:/a:ladon_project:ladon:0.8.2 cpe:/a:ladon_project:ladon:0.8.3 cpe:/a:ladon_project:ladon:0.8.4 cpe:/a:ladon_project:ladon:0.8.5 cpe:/a:ladon_project:ladon:0.8.6 cpe:/a:ladon_project:ladon:0.8.7 cpe:/a:ladon_project:ladon:0.8.8 cpe:/a:ladon_project:ladon:0.8.9 cpe:/a:ladon_project:ladon:0.9.0 cpe:/a:ladon_project:ladon:0.9.1 cpe:/a:ladon_project:ladon:0.9.3 cpe:/a:ladon_project:ladon:0.9.8 cpe:/a:ladon_project:ladon:0.9.9 cpe:/a:ladon_project:ladon:0.9.10 cpe:/a:ladon_project:ladon:0.9.11 cpe:/a:ladon_project:ladon:0.9.12 cpe:/a:ladon_project:ladon:0.9.13 cpe:/a:ladon_project:ladon:0.9.15 cpe:/a:ladon_project:ladon:0.9.16 cpe:/a:ladon_project:ladon:0.9.17 cpe:/a:ladon_project:ladon:0.9.18 cpe:/a:ladon_project:ladon:0.9.19 cpe:/a:ladon_project:ladon:0.9.20 cpe:/a:ladon_project:ladon:0.9.21 cpe:/a:ladon_project:ladon:0.9.22 cpe:/a:ladon_project:ladon:0.9.23 cpe:/a:ladon_project:ladon:0.9.24 cpe:/a:ladon_project:ladon:0.9.26 cpe:/a:ladon_project:ladon:0.9.27 cpe:/a:ladon_project:ladon:0.9.28 cpe:/a:ladon_project:ladon:0.9.29 cpe:/a:ladon_project:ladon:0.9.30 cpe:/a:ladon_project:ladon:0.9.31 cpe:/a:ladon_project:ladon:0.9.32 cpe:/a:ladon_project:ladon:0.9.33 cpe:/a:ladon_project:ladon:0.9.34 cpe:/a:ladon_project:ladon:0.9.35 cpe:/a:ladon_project:ladon:0.9.36 cpe:/a:ladon_project:ladon:0.9.37 cpe:/a:ladon_project:ladon:0.9.38 cpe:/a:ladon_project:ladon:0.9.39 cpe:/a:ladon_project:ladon:0.9.40

CVE-2019-1010268

2019-07-18T13:15:11.803-04:00

2019-07-24T13:39:51.877-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-18T22:31:37.557-04:00

MISC https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688 MISC https://www.exploit-db.com/exploits/43113 Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.

cpe:/a:helm:helm:1.0 cpe:/a:helm:helm:1.1 cpe:/a:helm:helm:1.2 cpe:/a:helm:helm:1.2.1 cpe:/a:helm:helm:2.0.0:- cpe:/a:helm:helm:2.0.0:alpha.1 cpe:/a:helm:helm:2.0.0:alpha.2 cpe:/a:helm:helm:2.0.0:alpha.3 cpe:/a:helm:helm:2.0.0:alpha.4 cpe:/a:helm:helm:2.0.0:alpha.5 cpe:/a:helm:helm:2.0.0:beta.1 cpe:/a:helm:helm:2.0.0:beta.2 cpe:/a:helm:helm:2.0.0:rc.1 cpe:/a:helm:helm:2.0.0:rc.2 cpe:/a:helm:helm:2.0.1 cpe:/a:helm:helm:2.0.2 cpe:/a:helm:helm:2.1.0 cpe:/a:helm:helm:2.1.1 cpe:/a:helm:helm:2.1.2 cpe:/a:helm:helm:2.1.3 cpe:/a:helm:helm:2.2.0 cpe:/a:helm:helm:2.2.1 cpe:/a:helm:helm:2.2.2 cpe:/a:helm:helm:2.2.3 cpe:/a:helm:helm:2.3.0 cpe:/a:helm:helm:2.3.1 cpe:/a:helm:helm:2.4.0 cpe:/a:helm:helm:2.4.1 cpe:/a:helm:helm:2.4.2 cpe:/a:helm:helm:2.5.0 cpe:/a:helm:helm:2.5.1 cpe:/a:helm:helm:2.6.0 cpe:/a:helm:helm:2.6.1 cpe:/a:helm:helm:2.6.2 cpe:/a:helm:helm:2.7.0:- cpe:/a:helm:helm:2.7.0:rc1 cpe:/a:helm:helm:2.7.1

CVE-2019-1010275

2019-07-17T17:15:10.953-04:00

2019-10-09T19:44:18.603-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/helm/helm/pull/3152 MISC https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50 MISC https://github.com/helm/helm/releases/tag/v2.7.2 helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.

cpe:/a:oisf:suricata:0.8.2 cpe:/a:oisf:suricata:1.0.0 cpe:/a:oisf:suricata:1.0.1 cpe:/a:oisf:suricata:1.0.2 cpe:/a:oisf:suricata:1.0.3 cpe:/a:oisf:suricata:1.0.4 cpe:/a:oisf:suricata:1.0.5 cpe:/a:oisf:suricata:1.1:- cpe:/a:oisf:suricata:1.1:beta1 cpe:/a:oisf:suricata:1.1:beta2 cpe:/a:oisf:suricata:1.1:beta3 cpe:/a:oisf:suricata:1.1:rc1 cpe:/a:oisf:suricata:1.1.1 cpe:/a:oisf:suricata:1.2:- cpe:/a:oisf:suricata:1.2:beta1 cpe:/a:oisf:suricata:1.2:rc1 cpe:/a:oisf:suricata:1.2.1 cpe:/a:oisf:suricata:1.3:- cpe:/a:oisf:suricata:1.3:beta1 cpe:/a:oisf:suricata:1.3:beta2 cpe:/a:oisf:suricata:1.3:rc1 cpe:/a:oisf:suricata:1.3.1 cpe:/a:oisf:suricata:1.3.2 cpe:/a:oisf:suricata:1.3.3 cpe:/a:oisf:suricata:1.3.4 cpe:/a:oisf:suricata:1.3.5 cpe:/a:oisf:suricata:1.3.6 cpe:/a:oisf:suricata:1.4:- cpe:/a:oisf:suricata:1.4:beta1 cpe:/a:oisf:suricata:1.4:beta2 cpe:/a:oisf:suricata:1.4:beta3 cpe:/a:oisf:suricata:1.4:rc1 cpe:/a:oisf:suricata:1.4.1 cpe:/a:oisf:suricata:1.4.2 cpe:/a:oisf:suricata:1.4.3 cpe:/a:oisf:suricata:1.4.4 cpe:/a:oisf:suricata:1.4.5 cpe:/a:oisf:suricata:1.4.6 cpe:/a:oisf:suricata:1.4.7 cpe:/a:oisf:suricata:2.0:- cpe:/a:oisf:suricata:2.0:beta1 cpe:/a:oisf:suricata:2.0:beta2 cpe:/a:oisf:suricata:2.0:rc1 cpe:/a:oisf:suricata:2.0:rc2 cpe:/a:oisf:suricata:2.0:rc3 cpe:/a:oisf:suricata:2.0.1 cpe:/a:oisf:suricata:2.0.1:rc1 cpe:/a:oisf:suricata:2.0.2 cpe:/a:oisf:suricata:2.0.3 cpe:/a:oisf:suricata:2.0.4 cpe:/a:oisf:suricata:2.0.5 cpe:/a:oisf:suricata:2.0.6 cpe:/a:oisf:suricata:2.0.7 cpe:/a:oisf:suricata:2.0.8 cpe:/a:oisf:suricata:2.0.9 cpe:/a:oisf:suricata:2.0.10 cpe:/a:oisf:suricata:2.0.11 cpe:/a:oisf:suricata:2.1:beta1 cpe:/a:oisf:suricata:2.1:beta2 cpe:/a:oisf:suricata:2.1:beta3 cpe:/a:oisf:suricata:2.1:beta4 cpe:/a:oisf:suricata:3.0:- cpe:/a:oisf:suricata:3.0:rc1 cpe:/a:oisf:suricata:3.0:rc2 cpe:/a:oisf:suricata:3.0:rc3 cpe:/a:oisf:suricata:3.0.1:- cpe:/a:oisf:suricata:3.0.1:rc1 cpe:/a:oisf:suricata:3.0.2 cpe:/a:oisf:suricata:3.1:- cpe:/a:oisf:suricata:3.1:rc1 cpe:/a:oisf:suricata:3.1.1 cpe:/a:oisf:suricata:3.1.2 cpe:/a:oisf:suricata:3.1.3 cpe:/a:oisf:suricata:3.1.4 cpe:/a:oisf:suricata:3.2:- cpe:/a:oisf:suricata:3.2:beta1 cpe:/a:oisf:suricata:3.2:rc1 cpe:/a:oisf:suricata:3.2.1 cpe:/a:oisf:suricata:3.2.2 cpe:/a:oisf:suricata:3.2.3 cpe:/a:oisf:suricata:3.2.4 cpe:/a:oisf:suricata:3.2.5 cpe:/a:oisf:suricata:4.0.0:- cpe:/a:oisf:suricata:4.0.0:beta1 cpe:/a:oisf:suricata:4.0.0:rc1 cpe:/a:oisf:suricata:4.0.0:rc2 cpe:/a:oisf:suricata:4.0.1 cpe:/a:oisf:suricata:4.0.2 cpe:/a:oisf:suricata:4.0.3 cpe:/a:oisf:suricata:4.0.4 cpe:/a:oisf:suricata:4.0.5 cpe:/a:oisf:suricata:4.0.6 cpe:/a:oisf:suricata:4.0.7 cpe:/a:oisf:suricata:4.1.0 cpe:/a:oisf:suricata:4.1.0:beta1 cpe:/a:oisf:suricata:4.1.0:rc1 cpe:/a:oisf:suricata:4.1.0:rc2 cpe:/a:oisf:suricata:4.1.1 cpe:/a:oisf:suricata:4.1.2

CVE-2019-1010279

2019-07-18T15:15:11.317-04:00

2019-08-01T08:14:53.783-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-29T10:41:33.763-04:00

MISC https://github.com/OISF/suricata/pull/3625 MISC https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b MISC https://redmine.openinfosecfoundation.org/issues/2770 Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.

cpe:/a:univention:univention_corporate_server:12.0.1-3

CVE-2019-1010283

2019-07-17T17:15:11.013-04:00

2019-10-09T19:44:18.820-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://forge.univention.org/bugzilla/show_bug.cgi?id=48427 MISC https://github.com/univention/univention-corporate-server/commit/a28053045bd2e778c50ed1acaf4e52e1e34f6e34 Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.

cpe:/a:timesheet_next_gen_project:timesheet_next_gen:1.5.3

CVE-2019-1010287

2019-07-17T17:15:11.093-04:00

2019-07-22T14:52:52.613-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-18T13:52:12.827-04:00

MISC https://sourceforge.net/p/tsheetx/code/497/tree/branches/legacy/login.php#l40 MISC https://sourceforge.net/p/tsheetx/discussion/779083/thread/7fcb52f696/ Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.

cpe:/a:cmsmadesimple:bable%3amultilingual_site:0.4.1::~~~cms_made_simple~~

CVE-2019-1010290

2019-07-16T10:15:11.903-04:00

2019-07-19T15:34:32.167-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-17T09:17:46.447-04:00

MISC http://dev.cmsmadesimple.org/project/files/729 MISC https://untrustednetwork.net/en/2019/02/20/open-redirection-vulnerability-in-babel/ Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.

cpe:/o:linaro:op-tee:0.1.0 cpe:/o:linaro:op-tee:0.2.0 cpe:/o:linaro:op-tee:0.3.0 cpe:/o:linaro:op-tee:1.0.0:- cpe:/o:linaro:op-tee:1.0.0:rc1 cpe:/o:linaro:op-tee:1.0.0:rc2 cpe:/o:linaro:op-tee:1.0.1 cpe:/o:linaro:op-tee:1.1.0 cpe:/o:linaro:op-tee:2.0.0 cpe:/o:linaro:op-tee:2.1.0 cpe:/o:linaro:op-tee:2.2.0 cpe:/o:linaro:op-tee:2.3.0 cpe:/o:linaro:op-tee:2.4.0 cpe:/o:linaro:op-tee:2.5.0:- cpe:/o:linaro:op-tee:2.5.0:rc1 cpe:/o:linaro:op-tee:2.5.0:rc2 cpe:/o:linaro:op-tee:2.6.0:- cpe:/o:linaro:op-tee:2.6.0:rc1 cpe:/o:linaro:op-tee:3.0.0:- cpe:/o:linaro:op-tee:3.0.0:rc1 cpe:/o:linaro:op-tee:3.0.0:rc2 cpe:/o:linaro:op-tee:3.1.0:- cpe:/o:linaro:op-tee:3.1.0:rc1 cpe:/o:linaro:op-tee:3.2.0:- cpe:/o:linaro:op-tee:3.2.0:rc1 cpe:/o:linaro:op-tee:3.3.0:- cpe:/o:linaro:op-tee:3.3.0:rc1 cpe:/o:linaro:op-tee:3.3.0:rc2

CVE-2019-1010292

2019-07-16T10:15:11.997-04:00

2019-07-22T14:46:37.220-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-17T08:42:00.067-04:00

MISC https://github.com/OP-TEE/optee_os/commit/e3adcf566cb278444830e7badfdcc3983e334fd1 Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010293

2019-07-15T14:15:11.303-04:00

2019-07-16T12:14:04.167-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T17:02:14.387-04:00

MISC https://github.com/OP-TEE/optee_os/commit/95f36d661f2b75887772ea28baaad904bde96970 Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010294

2019-07-15T14:15:11.383-04:00

2019-07-16T12:13:05.490-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T17:00:40.787-04:00

MISC https://github.com/OP-TEE/optee_os/commit/7e768f8a473409215fe3fff8f6e31f8a3a0103c6 Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010295

2019-07-15T14:15:11.443-04:00

2019-07-16T12:15:14.870-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T16:56:42.573-04:00

MISC https://github.com/OP-TEE/optee_os/commit/d5c5b0b77b2b589666024d219a8007b3f5b6faeb Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010296

2019-07-15T14:15:11.507-04:00

2019-07-16T12:15:27.200-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-15T16:46:46.890-04:00

MISC https://github.com/OP-TEE/optee_os/commit/b60e1cee406a1ff521145ab9534370dfb85dd592 Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010297

2019-07-15T14:15:11.587-04:00

2019-07-16T12:15:35.543-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-15T16:37:41.707-04:00

MISC https://github.com/OP-TEE/optee_os/commit/a637243270fc1faae16de059091795c32d86e65e Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/o:linaro:op-tee:3.3.0

CVE-2019-1010298

2019-07-15T14:15:11.647-04:00

2019-07-16T12:15:41.577-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-07-15T15:18:51.477-04:00

MISC https://github.com/OP-TEE/optee_os/commit/70697bf3c5dc3d201341b01a1a8e5bc6d2fb48f8 Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.

cpe:/a:rust-lang:rust:1.18.0 cpe:/a:rust-lang:rust:1.19.0 cpe:/a:rust-lang:rust:1.20.0 cpe:/a:rust-lang:rust:1.21.0 cpe:/a:rust-lang:rust:1.22.0 cpe:/a:rust-lang:rust:1.22.1 cpe:/a:rust-lang:rust:1.23.0 cpe:/a:rust-lang:rust:1.24.0 cpe:/a:rust-lang:rust:1.24.1 cpe:/a:rust-lang:rust:1.25.0 cpe:/a:rust-lang:rust:1.26.0 cpe:/a:rust-lang:rust:1.26.1 cpe:/a:rust-lang:rust:1.26.2 cpe:/a:rust-lang:rust:1.27.0 cpe:/a:rust-lang:rust:1.27.1 cpe:/a:rust-lang:rust:1.27.2 cpe:/a:rust-lang:rust:1.28.0 cpe:/a:rust-lang:rust:1.29.0 cpe:/a:rust-lang:rust:1.29.1 cpe:/a:rust-lang:rust:1.29.2

CVE-2019-1010299

2019-07-15T14:15:11.727-04:00

2019-10-09T19:44:19.197-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://github.com/rust-lang/rust/issues/53566 MISC https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.

cpe:/a:jetbrains:kotlin:0.9 cpe:/a:jetbrains:kotlin:1.2.70 cpe:/a:jetbrains:kotlin:1.3:- cpe:/a:jetbrains:kotlin:1.3:m2 cpe:/a:jetbrains:kotlin:1.3:rc cpe:/a:jetbrains:kotlin:1.3.20

CVE-2019-10103

2019-07-03T16:15:11.227-04:00

2019-07-12T09:57:42.167-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-07-08T11:28:38.213-04:00

CONFIRM https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101.

cpe:/a:mz-automation:libiec61850:1.3.0 cpe:/a:mz-automation:libiec61850:1.3.1 cpe:/a:mz-automation:libiec61850:1.3.2

CVE-2019-1010300

2019-07-15T14:15:11.803-04:00

2019-07-22T15:38:11.743-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-17T12:59:27.873-04:00

MISC https://github.com/mz-automation/libiec61850/issues/127 mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet.

cpe:/a:jhead_project:jhead:3.03

CVE-2019-1010301

2019-07-15T14:15:11.883-04:00

2019-08-12T10:15:13.267-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251 MISC https://bugzilla.redhat.com/show_bug.cgi?id=1679952 MISC https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo FEDORA FEDORA-2019-17b95fecd3 FEDORA FEDORA-2019-441c2fb0d1 jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file.

cpe:/a:jhead_project:jhead:3.03

CVE-2019-1010302

2019-07-15T14:15:11.943-04:00

2019-08-13T23:15:10.863-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://bugzilla.redhat.com/show_bug.cgi?id=1679978 FEDORA FEDORA-2019-17b95fecd3 FEDORA FEDORA-2019-441c2fb0d1 jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file.

cpe:/a:mirumee:saleor:2.0.0 cpe:/a:mirumee:saleor:2.1.0 cpe:/a:mirumee:saleor:2.2.0 cpe:/a:mirumee:saleor:2.3.0

CVE-2019-1010304

2019-07-15T11:15:11.297-04:00

2019-07-30T13:15:24.937-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T13:36:38.293-04:00

MISC https://github.com/mirumee/saleor/issues/3768 Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.

cpe:/a:kyzer:libmspack:0.9.1:alpha cpe:/o:canonical:ubuntu_linux:12.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~esm~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ cpe:/o:fedoraproject:fedora:29 cpe:/o:fedoraproject:fedora:30

CVE-2019-1010305

2019-07-15T11:15:11.377-04:00

2019-08-23T19:15:10.777-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d MISC https://github.com/kyz/libmspack/issues/27 MLIST [debian-lts-announce] 20190823 [SECURITY] [DLA 1895-1] libmspack security update FEDORA FEDORA-2019-da6be81bd3 FEDORA FEDORA-2019-6235a32624 UBUNTU USN-4066-1 UBUNTU USN-4066-2 libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.

cpe:/a:teller:slanger:0.6.0

CVE-2019-1010306

2019-07-15T11:15:11.470-04:00

2019-07-30T13:14:16.057-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-15T13:04:36.673-04:00

MISC https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3 Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.

cpe:/a:glpi-project:glpi:9.3.1

CVE-2019-1010307

2019-07-15T14:15:12.007-04:00

2019-07-18T09:22:43.300-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T15:03:12.353-04:00

MISC https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php MISC https://github.com/glpi-project/glpi/releases/tag/9.3.1 GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.

cpe:/a:aquaverde:aquarius_cms:3.6.5 cpe:/a:aquaverde:aquarius_cms:3.6.7 cpe:/a:aquaverde:aquarius_cms:3.6.9 cpe:/a:aquaverde:aquarius_cms:3.7.0 cpe:/a:aquaverde:aquarius_cms:3.7.1 cpe:/a:aquaverde:aquarius_cms:3.8.0 cpe:/a:aquaverde:aquarius_cms:3.9.0 cpe:/a:aquaverde:aquarius_cms:4.0.0 cpe:/a:aquaverde:aquarius_cms:4.1.0

CVE-2019-1010308

2019-07-15T14:15:12.070-04:00

2019-07-22T14:25:39.743-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T15:38:31.877-04:00

MISC https://github.com/aquaverde/aquarius-core MISC https://github.com/aquaverde/aquarius-core/commit/e1af89aa9df07ea265d879518ede9eb98aa494e0 Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.

CVE-2019-1010309

2019-07-12T14:15:11.480-04:00

2019-07-12T21:15:10.417-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-9686. Reason: This candidate is a reservation duplicate of CVE-2019-9686. Notes: All CVE users should reference CVE-2019-9686 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:glpi-project:glpi:9.3.1

CVE-2019-1010310

2019-07-12T14:15:11.560-04:00

2019-07-18T11:55:44.713-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-15T15:04:19.263-04:00

MISC https://github.com/glpi-project/glpi/pull/5519 MISC https://github.com/glpi-project/glpi/releases/tag/9.3.1 GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. The fixed version is: 9.4.1.

CVE-2019-1010311

2019-07-12T14:15:11.637-04:00

2019-07-12T20:15:10.497-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11454. Reason: This candidate is a reservation duplicate of CVE-2019-11454. Notes: All CVE users should reference CVE-2019-11454 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2019-1010312

2019-07-12T14:15:11.700-04:00

2019-07-12T20:15:10.573-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11455. Reason: This candidate is a reservation duplicate of CVE-2019-11455. Notes: All CVE users should reference CVE-2019-11455 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:gitea:gitea:1.7.2 cpe:/a:gitea:gitea:1.7.3

CVE-2019-1010314

2019-07-11T16:15:12.037-04:00

2019-07-12T13:03:26.547-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-07-11T23:23:44.537-04:00

MISC https://github.com/go-gitea/gitea/releases Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.

cpe:/a:wavpack:wavpack:5.1.0

CVE-2019-1010315

2019-07-11T16:15:12.100-04:00

2019-07-16T17:15:11.283-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc MISC https://github.com/dbry/WavPack/issues/65 UBUNTU USN-4062-1 WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.

cpe:/a:pyxtrlock_project:pyxtrlock:0.3

CVE-2019-1010316

2019-07-11T16:15:12.163-04:00

2019-07-14T17:42:13.107-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-11T23:37:37.357-04:00

MISC https://github.com/leonnnn/pyxtrlock/issues/21 pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is: 0.4.

cpe:/a:wavpack:wavpack:5.1.0

CVE-2019-1010317

2019-07-11T16:15:12.227-04:00

2019-07-16T17:15:11.393-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b MISC https://github.com/dbry/WavPack/issues/66 FEDORA FEDORA-2019-8eeb8f9d3f FEDORA FEDORA-2019-c72f5f6361 UBUNTU USN-4062-1 WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.

CVE-2019-1010318

2019-07-11T16:15:12.303-04:00

2019-07-14T13:15:10.807-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11498. Reason: This candidate is a reservation duplicate of CVE-2019-11498. Notes: All CVE users should reference CVE-2019-11498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:wavpack:wavpack:5.1.0

CVE-2019-1010319

2019-07-11T16:15:12.367-04:00

2019-07-16T17:15:11.533-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe MISC https://github.com/dbry/WavPack/issues/68 FEDORA FEDORA-2019-8eeb8f9d3f FEDORA FEDORA-2019-c72f5f6361 UBUNTU USN-4062-1 WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.

cpe:/a:jetbrains:intellij_idea:2018.1 cpe:/a:jetbrains:intellij_idea:2018.1.1 cpe:/a:jetbrains:intellij_idea:2018.1.2 cpe:/a:jetbrains:intellij_idea:2018.1.3 cpe:/a:jetbrains:intellij_idea:2018.1.4 cpe:/a:jetbrains:intellij_idea:2018.1.5 cpe:/a:jetbrains:intellij_idea:2018.1.6 cpe:/a:jetbrains:intellij_idea:2018.1.7 cpe:/a:jetbrains:intellij_idea:2018.2 cpe:/a:jetbrains:intellij_idea:2018.2.1 cpe:/a:jetbrains:intellij_idea:2018.2.2 cpe:/a:jetbrains:intellij_idea:2018.2.3 cpe:/a:jetbrains:intellij_idea:2018.2.4 cpe:/a:jetbrains:intellij_idea:2018.2.5 cpe:/a:jetbrains:intellij_idea:2018.2.6 cpe:/a:jetbrains:intellij_idea:2018.2.7 cpe:/a:jetbrains:intellij_idea:2018.3 cpe:/a:jetbrains:intellij_idea:2018.3.1 cpe:/a:jetbrains:intellij_idea:2018.3.2 cpe:/a:jetbrains:intellij_idea:2018.3.3 cpe:/a:jetbrains:intellij_idea:2018.3.5 cpe:/a:jetbrains:intellij_idea:2018.3.6

CVE-2019-10104

2019-07-03T15:15:12.190-04:00

2019-07-10T11:26:49.027-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-07-08T07:52:22.477-04:00

CONFIRM https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/ In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.

cpe:/a:cmsmadesimple:cms_made_simple:2.2.10

CVE-2019-10105

2019-03-26T18:29:00.520-04:00

2019-03-27T08:29:04.777-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T22:35:50.777-04:00

MISC http://dev.cmsmadesimple.org/bug/view/12002 CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.

cpe:/a:cmsmadesimple:cms_made_simple:2.2.10

CVE-2019-10106

2019-03-26T18:29:00.567-04:00

2019-03-27T08:14:57.383-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T22:36:56.137-04:00

MISC http://dev.cmsmadesimple.org/bug/view/12004 CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.

cpe:/a:cmsmadesimple:cms_made_simple:2.2.10

CVE-2019-10107

2019-03-26T18:29:00.630-04:00

2019-03-27T08:27:34.820-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-03-26T22:36:33.167-04:00

MISC http://dev.cmsmadesimple.org/bug/view/12003 CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.

cpe:/a:gitlab:gitlab:0.8.0::~~community~~~ cpe:/a:gitlab:gitlab:0.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:0.9.1::~~community~~~ cpe:/a:gitlab:gitlab:0.9.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:0.9.4::~~community~~~ cpe:/a:gitlab:gitlab:0.9.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:0.9.5::~~community~~~ cpe:/a:gitlab:gitlab:0.9.6::~~community~~~ cpe:/a:gitlab:gitlab:0.9.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.0.0::~~community~~~ cpe:/a:gitlab:gitlab:1.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.0.1::~~community~~~ cpe:/a:gitlab:gitlab:1.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.0.2::~~community~~~ cpe:/a:gitlab:gitlab:1.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.1.0::~~community~~~ cpe:/a:gitlab:gitlab:1.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.1.0:-:~~community~~~ cpe:/a:gitlab:gitlab:1.1.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:1.2.0::~~community~~~ cpe:/a:gitlab:gitlab:1.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.2.0:-:~~community~~~ cpe:/a:gitlab:gitlab:1.2.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:1.2.1::~~community~~~ cpe:/a:gitlab:gitlab:1.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:1.2.2::~~community~~~ cpe:/a:gitlab:gitlab:1.2.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.0.0::~~community~~~ cpe:/a:gitlab:gitlab:2.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.1.0::~~community~~~ cpe:/a:gitlab:gitlab:2.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.2.0::~~community~~~ cpe:/a:gitlab:gitlab:2.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.2.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.2.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.3.0::~~community~~~ cpe:/a:gitlab:gitlab:2.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.3.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.3.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.3.1::~~community~~~ cpe:/a:gitlab:gitlab:2.3.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.4.0::~~community~~~ cpe:/a:gitlab:gitlab:2.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.4.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.4.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.4.1::~~community~~~ cpe:/a:gitlab:gitlab:2.4.2::~~community~~~ cpe:/a:gitlab:gitlab:2.5.0::~~community~~~ cpe:/a:gitlab:gitlab:2.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.6.0::~~community~~~ cpe:/a:gitlab:gitlab:2.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.6.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.6.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.6.1::~~community~~~ cpe:/a:gitlab:gitlab:2.6.2::~~community~~~ cpe:/a:gitlab:gitlab:2.6.3::~~community~~~ cpe:/a:gitlab:gitlab:2.7.0::~~community~~~ cpe:/a:gitlab:gitlab:2.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.7.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.7.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.8.0::~~community~~~ cpe:/a:gitlab:gitlab:2.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.8.0:-:~~community~~~ cpe:/a:gitlab:gitlab:2.8.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:2.8.1::~~community~~~ cpe:/a:gitlab:gitlab:2.8.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.8.2::~~community~~~ cpe:/a:gitlab:gitlab:2.9.0::~~community~~~ cpe:/a:gitlab:gitlab:2.9.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:2.9.1::~~community~~~ cpe:/a:gitlab:gitlab:2.9.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:3.0.0::~~community~~~ cpe:/a:gitlab:gitlab:3.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:3.0.1::~~community~~~ cpe:/a:gitlab:gitlab:3.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:3.0.2::~~community~~~ cpe:/a:gitlab:gitlab:3.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:3.0.3::~~community~~~ cpe:/a:gitlab:gitlab:3.0.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:3.1.0::~~community~~~ cpe:/a:gitlab:gitlab:3.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:4.0.0::~~community~~~ cpe:/a:gitlab:gitlab:4.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:4.0.0:-:~~community~~~ cpe:/a:gitlab:gitlab:4.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:4.0.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:4.1.0::~~community~~~ cpe:/a:gitlab:gitlab:4.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:4.2.0::~~community~~~ cpe:/a:gitlab:gitlab:4.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.0.0::~~community~~~ cpe:/a:gitlab:gitlab:5.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.0.1::~~community~~~ cpe:/a:gitlab:gitlab:5.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.1.0::~~community~~~ cpe:/a:gitlab:gitlab:5.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.2.0::~~community~~~ cpe:/a:gitlab:gitlab:5.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.2.1::~~community~~~ cpe:/a:gitlab:gitlab:5.3.0::~~community~~~ cpe:/a:gitlab:gitlab:5.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.4.0::~~community~~~ cpe:/a:gitlab:gitlab:5.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.4.1::~~community~~~ cpe:/a:gitlab:gitlab:5.4.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:5.4.2::~~community~~~ cpe:/a:gitlab:gitlab:5.4.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.0.0::~~community~~~ cpe:/a:gitlab:gitlab:6.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.0.1::~~community~~~ cpe:/a:gitlab:gitlab:6.0.2::~~community~~~ cpe:/a:gitlab:gitlab:6.1.0::~~community~~~ cpe:/a:gitlab:gitlab:6.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.2.0::~~community~~~ cpe:/a:gitlab:gitlab:6.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.2.1::~~community~~~ cpe:/a:gitlab:gitlab:6.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.2.2::~~community~~~ cpe:/a:gitlab:gitlab:6.2.3::~~community~~~ cpe:/a:gitlab:gitlab:6.2.4::~~community~~~ cpe:/a:gitlab:gitlab:6.3.0::~~community~~~ cpe:/a:gitlab:gitlab:6.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.3.1::~~community~~~ cpe:/a:gitlab:gitlab:6.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.4.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.4.0:pre1:~~community~~~ cpe:/a:gitlab:gitlab:6.4.0:pre2:~~community~~~ cpe:/a:gitlab:gitlab:6.4.0:pre3:~~community~~~ cpe:/a:gitlab:gitlab:6.4.1::~~community~~~ cpe:/a:gitlab:gitlab:6.4.2::~~community~~~ cpe:/a:gitlab:gitlab:6.4.3::~~community~~~ cpe:/a:gitlab:gitlab:6.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.5.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:6.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.6.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.6.0:pre1:~~community~~~ cpe:/a:gitlab:gitlab:6.6.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:6.6.1::~~community~~~ cpe:/a:gitlab:gitlab:6.6.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.6.2::~~community~~~ cpe:/a:gitlab:gitlab:6.6.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.6.3::~~community~~~ cpe:/a:gitlab:gitlab:6.6.4::~~community~~~ cpe:/a:gitlab:gitlab:6.6.5::~~community~~~ cpe:/a:gitlab:gitlab:6.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.7.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.7.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:6.7.1::~~community~~~ cpe:/a:gitlab:gitlab:6.7.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.7.2::~~community~~~ cpe:/a:gitlab:gitlab:6.7.3::~~community~~~ cpe:/a:gitlab:gitlab:6.7.4::~~community~~~ cpe:/a:gitlab:gitlab:6.7.5::~~community~~~ cpe:/a:gitlab:gitlab:6.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.8.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.8.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:6.8.1::~~community~~~ cpe:/a:gitlab:gitlab:6.8.2::~~community~~~ cpe:/a:gitlab:gitlab:6.9.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.9.0:-:~~community~~~ cpe:/a:gitlab:gitlab:6.9.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:6.9.1::~~community~~~ cpe:/a:gitlab:gitlab:6.9.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.9.2::~~community~~~ cpe:/a:gitlab:gitlab:6.9.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.9.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:6.9.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.0.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.1.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.1.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.1.1::~~community~~~ cpe:/a:gitlab:gitlab:7.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.2.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.2.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.2.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.2.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.2.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:7.2.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:7.2.1::~~community~~~ cpe:/a:gitlab:gitlab:7.2.2::~~community~~~ cpe:/a:gitlab:gitlab:7.2.3::~~community~~~ cpe:/a:gitlab:gitlab:7.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.3.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.3.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.3.1::~~community~~~ cpe:/a:gitlab:gitlab:7.3.2::~~community~~~ cpe:/a:gitlab:gitlab:7.3.3::~~community~~~ cpe:/a:gitlab:gitlab:7.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.4.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.4.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.4.1::~~community~~~ cpe:/a:gitlab:gitlab:7.4.2::~~community~~~ cpe:/a:gitlab:gitlab:7.4.3::~~community~~~ cpe:/a:gitlab:gitlab:7.4.4::~~community~~~ cpe:/a:gitlab:gitlab:7.4.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.4.5::~~community~~~ cpe:/a:gitlab:gitlab:7.5.0::~~community~~~ cpe:/a:gitlab:gitlab:7.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.5.1::~~community~~~ cpe:/a:gitlab:gitlab:7.5.2::~~community~~~ cpe:/a:gitlab:gitlab:7.5.3::~~community~~~ cpe:/a:gitlab:gitlab:7.5.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.6.0::~~community~~~ cpe:/a:gitlab:gitlab:7.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.6.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.6.1::~~community~~~ cpe:/a:gitlab:gitlab:7.6.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.6.2::~~community~~~ cpe:/a:gitlab:gitlab:7.6.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.7.0::~~community~~~ cpe:/a:gitlab:gitlab:7.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.7.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.7.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.7.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.7.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:7.7.1::~~community~~~ cpe:/a:gitlab:gitlab:7.7.2::~~community~~~ cpe:/a:gitlab:gitlab:7.8.0::~~community~~~ cpe:/a:gitlab:gitlab:7.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.8.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.8.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.8.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.8.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:7.8.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:7.8.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:7.8.1::~~community~~~ cpe:/a:gitlab:gitlab:7.8.2::~~community~~~ cpe:/a:gitlab:gitlab:7.8.3::~~community~~~ cpe:/a:gitlab:gitlab:7.8.4::~~community~~~ cpe:/a:gitlab:gitlab:7.9.0::~~community~~~ cpe:/a:gitlab:gitlab:7.9.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.9.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.9.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.9.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.9.1::~~community~~~ cpe:/a:gitlab:gitlab:7.9.2::~~community~~~ cpe:/a:gitlab:gitlab:7.9.3::~~community~~~ cpe:/a:gitlab:gitlab:7.9.4::~~community~~~ cpe:/a:gitlab:gitlab:7.10.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.10.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:7.10.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:7.10.1::~~community~~~ cpe:/a:gitlab:gitlab:7.10.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.10.2::~~community~~~ cpe:/a:gitlab:gitlab:7.10.3::~~community~~~ cpe:/a:gitlab:gitlab:7.10.4::~~community~~~ cpe:/a:gitlab:gitlab:7.10.5::~~community~~~ cpe:/a:gitlab:gitlab:7.11.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.11.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.11.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.11.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.11.1::~~community~~~ cpe:/a:gitlab:gitlab:7.11.2::~~community~~~ cpe:/a:gitlab:gitlab:7.11.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.11.3::~~community~~~ cpe:/a:gitlab:gitlab:7.11.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.11.4::~~community~~~ cpe:/a:gitlab:gitlab:7.11.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.12.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.12.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.12.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.12.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.12.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.12.1::~~community~~~ cpe:/a:gitlab:gitlab:7.12.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.12.2::~~community~~~ cpe:/a:gitlab:gitlab:7.12.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.13.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.13.0:-:~~community~~~ cpe:/a:gitlab:gitlab:7.13.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.13.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.13.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.13.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:7.13.1::~~community~~~ cpe:/a:gitlab:gitlab:7.13.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.13.2::~~community~~~ cpe:/a:gitlab:gitlab:7.13.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.13.3::~~community~~~ cpe:/a:gitlab:gitlab:7.13.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.13.4::~~community~~~ cpe:/a:gitlab:gitlab:7.13.5::~~community~~~ cpe:/a:gitlab:gitlab:7.14.0::~~community~~~ cpe:/a:gitlab:gitlab:7.14.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.14.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:7.14.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:7.14.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:7.14.1::~~community~~~ cpe:/a:gitlab:gitlab:7.14.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.14.2::~~community~~~ cpe:/a:gitlab:gitlab:7.14.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:7.14.3::~~community~~~ cpe:/a:gitlab:gitlab:7.14.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.0:-:~~community~~~ cpe:/a:gitlab:gitlab:8.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.0.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.0.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.0.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.0.1::~~community~~~ cpe:/a:gitlab:gitlab:8.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.2::~~community~~~ cpe:/a:gitlab:gitlab:8.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.3::~~community~~~ cpe:/a:gitlab:gitlab:8.0.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.4::~~community~~~ cpe:/a:gitlab:gitlab:8.0.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.5::~~community~~~ cpe:/a:gitlab:gitlab:8.0.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.0.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.1.0:-:~~community~~~ cpe:/a:gitlab:gitlab:8.1.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.1.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.1.1::~~community~~~ cpe:/a:gitlab:gitlab:8.1.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.1.2::~~community~~~ cpe:/a:gitlab:gitlab:8.1.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.1.3::~~community~~~ cpe:/a:gitlab:gitlab:8.1.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.1.4::~~community~~~ cpe:/a:gitlab:gitlab:8.1.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.0::~~community~~~ cpe:/a:gitlab:gitlab:8.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.2.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.2.1::~~community~~~ cpe:/a:gitlab:gitlab:8.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.2::~~community~~~ cpe:/a:gitlab:gitlab:8.2.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.3::~~community~~~ cpe:/a:gitlab:gitlab:8.2.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.4::~~community~~~ cpe:/a:gitlab:gitlab:8.2.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.5::~~community~~~ cpe:/a:gitlab:gitlab:8.2.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.2.6::~~community~~~ cpe:/a:gitlab:gitlab:8.2.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.0::~~community~~~ cpe:/a:gitlab:gitlab:8.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.3.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.3.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.3.1::~~community~~~ cpe:/a:gitlab:gitlab:8.3.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.2::~~community~~~ cpe:/a:gitlab:gitlab:8.3.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.3::~~community~~~ cpe:/a:gitlab:gitlab:8.3.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.4::~~community~~~ cpe:/a:gitlab:gitlab:8.3.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.5::~~community~~~ cpe:/a:gitlab:gitlab:8.3.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.6::~~community~~~ cpe:/a:gitlab:gitlab:8.3.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.7::~~community~~~ cpe:/a:gitlab:gitlab:8.3.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.8::~~community~~~ cpe:/a:gitlab:gitlab:8.3.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.9::~~community~~~ cpe:/a:gitlab:gitlab:8.3.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.3.10::~~community~~~ cpe:/a:gitlab:gitlab:8.3.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.0::~~community~~~ cpe:/a:gitlab:gitlab:8.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.4.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.4.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.4.1::~~community~~~ cpe:/a:gitlab:gitlab:8.4.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.2::~~community~~~ cpe:/a:gitlab:gitlab:8.4.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.3::~~community~~~ cpe:/a:gitlab:gitlab:8.4.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.4::~~community~~~ cpe:/a:gitlab:gitlab:8.4.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.5::~~community~~~ cpe:/a:gitlab:gitlab:8.4.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.6::~~community~~~ cpe:/a:gitlab:gitlab:8.4.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.7::~~community~~~ cpe:/a:gitlab:gitlab:8.4.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.8::~~community~~~ cpe:/a:gitlab:gitlab:8.4.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.9::~~community~~~ cpe:/a:gitlab:gitlab:8.4.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.10::~~community~~~ cpe:/a:gitlab:gitlab:8.4.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.4.11::~~community~~~ cpe:/a:gitlab:gitlab:8.4.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.0::~~community~~~ cpe:/a:gitlab:gitlab:8.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.5.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.5.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.5.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.5.1::~~community~~~ cpe:/a:gitlab:gitlab:8.5.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.2::~~community~~~ cpe:/a:gitlab:gitlab:8.5.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.3::~~community~~~ cpe:/a:gitlab:gitlab:8.5.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.4::~~community~~~ cpe:/a:gitlab:gitlab:8.5.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.5:-:~~community~~~ cpe:/a:gitlab:gitlab:8.5.5:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.5.6::~~community~~~ cpe:/a:gitlab:gitlab:8.5.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.7::~~community~~~ cpe:/a:gitlab:gitlab:8.5.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.8::~~community~~~ cpe:/a:gitlab:gitlab:8.5.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.9::~~community~~~ cpe:/a:gitlab:gitlab:8.5.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.10::~~community~~~ cpe:/a:gitlab:gitlab:8.5.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.11::~~community~~~ cpe:/a:gitlab:gitlab:8.5.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.12::~~community~~~ cpe:/a:gitlab:gitlab:8.5.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.5.13::~~community~~~ cpe:/a:gitlab:gitlab:8.5.13::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.0::~~community~~~ cpe:/a:gitlab:gitlab:8.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.6.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.6.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.6.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.6.1::~~community~~~ cpe:/a:gitlab:gitlab:8.6.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.2::~~community~~~ cpe:/a:gitlab:gitlab:8.6.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.3::~~community~~~ cpe:/a:gitlab:gitlab:8.6.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.4::~~community~~~ cpe:/a:gitlab:gitlab:8.6.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.5::~~community~~~ cpe:/a:gitlab:gitlab:8.6.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.6::~~community~~~ cpe:/a:gitlab:gitlab:8.6.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.7::~~community~~~ cpe:/a:gitlab:gitlab:8.6.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.8::~~community~~~ cpe:/a:gitlab:gitlab:8.6.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.6.9::~~community~~~ cpe:/a:gitlab:gitlab:8.6.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.0::~~community~~~ cpe:/a:gitlab:gitlab:8.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.7.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.7.1::~~community~~~ cpe:/a:gitlab:gitlab:8.7.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.2::~~community~~~ cpe:/a:gitlab:gitlab:8.7.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.3::~~community~~~ cpe:/a:gitlab:gitlab:8.7.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.4::~~community~~~ cpe:/a:gitlab:gitlab:8.7.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.5::~~community~~~ cpe:/a:gitlab:gitlab:8.7.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.6::~~community~~~ cpe:/a:gitlab:gitlab:8.7.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.7::~~community~~~ cpe:/a:gitlab:gitlab:8.7.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.8::~~community~~~ cpe:/a:gitlab:gitlab:8.7.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.7.9::~~community~~~ cpe:/a:gitlab:gitlab:8.7.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.0::~~community~~~ cpe:/a:gitlab:gitlab:8.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.8.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.8.1::~~community~~~ cpe:/a:gitlab:gitlab:8.8.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.2::~~community~~~ cpe:/a:gitlab:gitlab:8.8.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.3::~~community~~~ cpe:/a:gitlab:gitlab:8.8.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.4::~~community~~~ cpe:/a:gitlab:gitlab:8.8.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.5::~~community~~~ cpe:/a:gitlab:gitlab:8.8.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.6::~~community~~~ cpe:/a:gitlab:gitlab:8.8.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.7::~~community~~~ cpe:/a:gitlab:gitlab:8.8.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.8::~~community~~~ cpe:/a:gitlab:gitlab:8.8.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.8.9::~~community~~~ cpe:/a:gitlab:gitlab:8.8.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.0::~~community~~~ cpe:/a:gitlab:gitlab:8.9.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.9.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:8.9.1::~~community~~~ cpe:/a:gitlab:gitlab:8.9.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.2::~~community~~~ cpe:/a:gitlab:gitlab:8.9.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.3::~~community~~~ cpe:/a:gitlab:gitlab:8.9.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.4::~~community~~~ cpe:/a:gitlab:gitlab:8.9.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.5::~~community~~~ cpe:/a:gitlab:gitlab:8.9.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.6::~~community~~~ cpe:/a:gitlab:gitlab:8.9.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.7::~~community~~~ cpe:/a:gitlab:gitlab:8.9.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.8::~~community~~~ cpe:/a:gitlab:gitlab:8.9.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.9::~~community~~~ cpe:/a:gitlab:gitlab:8.9.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.10::~~community~~~ cpe:/a:gitlab:gitlab:8.9.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.9.11::~~community~~~ cpe:/a:gitlab:gitlab:8.9.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.0::~~community~~~ cpe:/a:gitlab:gitlab:8.10.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc11:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc12:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc13:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:8.10.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:8.10.1::~~community~~~ cpe:/a:gitlab:gitlab:8.10.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.2::~~community~~~ cpe:/a:gitlab:gitlab:8.10.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.3::~~community~~~ cpe:/a:gitlab:gitlab:8.10.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.4::~~community~~~ cpe:/a:gitlab:gitlab:8.10.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.5::~~community~~~ cpe:/a:gitlab:gitlab:8.10.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.6::~~community~~~ cpe:/a:gitlab:gitlab:8.10.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.7::~~community~~~ cpe:/a:gitlab:gitlab:8.10.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.8::~~community~~~ cpe:/a:gitlab:gitlab:8.10.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.9::~~community~~~ cpe:/a:gitlab:gitlab:8.10.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.10::~~community~~~ cpe:/a:gitlab:gitlab:8.10.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.11::~~community~~~ cpe:/a:gitlab:gitlab:8.10.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.12::~~community~~~ cpe:/a:gitlab:gitlab:8.10.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.10.13::~~community~~~ cpe:/a:gitlab:gitlab:8.10.13::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.0::~~community~~~ cpe:/a:gitlab:gitlab:8.11.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.11.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.11.1::~~community~~~ cpe:/a:gitlab:gitlab:8.11.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.2::~~community~~~ cpe:/a:gitlab:gitlab:8.11.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.3::~~community~~~ cpe:/a:gitlab:gitlab:8.11.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.4::~~community~~~ cpe:/a:gitlab:gitlab:8.11.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.5::~~community~~~ cpe:/a:gitlab:gitlab:8.11.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.6::~~community~~~ cpe:/a:gitlab:gitlab:8.11.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.7::~~community~~~ cpe:/a:gitlab:gitlab:8.11.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.8::~~community~~~ cpe:/a:gitlab:gitlab:8.11.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.9::~~community~~~ cpe:/a:gitlab:gitlab:8.11.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.10::~~community~~~ cpe:/a:gitlab:gitlab:8.11.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.11.11::~~community~~~ cpe:/a:gitlab:gitlab:8.11.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.0::~~community~~~ cpe:/a:gitlab:gitlab:8.12.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.12.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.12.1::~~community~~~ cpe:/a:gitlab:gitlab:8.12.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.2::~~community~~~ cpe:/a:gitlab:gitlab:8.12.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.3::~~community~~~ cpe:/a:gitlab:gitlab:8.12.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.4::~~community~~~ cpe:/a:gitlab:gitlab:8.12.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.5::~~community~~~ cpe:/a:gitlab:gitlab:8.12.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.6::~~community~~~ cpe:/a:gitlab:gitlab:8.12.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.7::~~community~~~ cpe:/a:gitlab:gitlab:8.12.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.8::~~community~~~ cpe:/a:gitlab:gitlab:8.12.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.9::~~community~~~ cpe:/a:gitlab:gitlab:8.12.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.10::~~community~~~ cpe:/a:gitlab:gitlab:8.12.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.11::~~community~~~ cpe:/a:gitlab:gitlab:8.12.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.12::~~community~~~ cpe:/a:gitlab:gitlab:8.12.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.12.13::~~community~~~ cpe:/a:gitlab:gitlab:8.13.0::~~community~~~ cpe:/a:gitlab:gitlab:8.13.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.13.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:8.13.1::~~community~~~ cpe:/a:gitlab:gitlab:8.13.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.2::~~community~~~ cpe:/a:gitlab:gitlab:8.13.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.3::~~community~~~ cpe:/a:gitlab:gitlab:8.13.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.4::~~community~~~ cpe:/a:gitlab:gitlab:8.13.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.5::~~community~~~ cpe:/a:gitlab:gitlab:8.13.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.6::~~community~~~ cpe:/a:gitlab:gitlab:8.13.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.7::~~community~~~ cpe:/a:gitlab:gitlab:8.13.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.8::~~community~~~ cpe:/a:gitlab:gitlab:8.13.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.9::~~community~~~ cpe:/a:gitlab:gitlab:8.13.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.10::~~community~~~ cpe:/a:gitlab:gitlab:8.13.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.11::~~community~~~ cpe:/a:gitlab:gitlab:8.13.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.13.12::~~community~~~ cpe:/a:gitlab:gitlab:8.13.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.0::~~community~~~ cpe:/a:gitlab:gitlab:8.14.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.14.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.14.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.14.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.14.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.14.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.14.1::~~community~~~ cpe:/a:gitlab:gitlab:8.14.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.2::~~community~~~ cpe:/a:gitlab:gitlab:8.14.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.3::~~community~~~ cpe:/a:gitlab:gitlab:8.14.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.4::~~community~~~ cpe:/a:gitlab:gitlab:8.14.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.5::~~community~~~ cpe:/a:gitlab:gitlab:8.14.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.6::~~community~~~ cpe:/a:gitlab:gitlab:8.14.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.7::~~community~~~ cpe:/a:gitlab:gitlab:8.14.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.8::~~community~~~ cpe:/a:gitlab:gitlab:8.14.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.9::~~community~~~ cpe:/a:gitlab:gitlab:8.14.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.14.10::~~community~~~ cpe:/a:gitlab:gitlab:8.14.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.0::~~community~~~ cpe:/a:gitlab:gitlab:8.15.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.1::~~community~~~ cpe:/a:gitlab:gitlab:8.15.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.2::~~community~~~ cpe:/a:gitlab:gitlab:8.15.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.3::~~community~~~ cpe:/a:gitlab:gitlab:8.15.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.4::~~community~~~ cpe:/a:gitlab:gitlab:8.15.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.5::~~community~~~ cpe:/a:gitlab:gitlab:8.15.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.6::~~community~~~ cpe:/a:gitlab:gitlab:8.15.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.7::~~community~~~ cpe:/a:gitlab:gitlab:8.15.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.15.8::~~community~~~ cpe:/a:gitlab:gitlab:8.15.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.0::~~community~~~ cpe:/a:gitlab:gitlab:8.16.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.16.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:8.16.1::~~community~~~ cpe:/a:gitlab:gitlab:8.16.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.2::~~community~~~ cpe:/a:gitlab:gitlab:8.16.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.3::~~community~~~ cpe:/a:gitlab:gitlab:8.16.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.4::~~community~~~ cpe:/a:gitlab:gitlab:8.16.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.5::~~community~~~ cpe:/a:gitlab:gitlab:8.16.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.6::~~community~~~ cpe:/a:gitlab:gitlab:8.16.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.7::~~community~~~ cpe:/a:gitlab:gitlab:8.16.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.8::~~community~~~ cpe:/a:gitlab:gitlab:8.16.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.16.9::~~community~~~ cpe:/a:gitlab:gitlab:8.16.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.0::~~community~~~ cpe:/a:gitlab:gitlab:8.17.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:8.17.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:8.17.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:8.17.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:8.17.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:8.17.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:8.17.1::~~community~~~ cpe:/a:gitlab:gitlab:8.17.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.2::~~community~~~ cpe:/a:gitlab:gitlab:8.17.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.3::~~community~~~ cpe:/a:gitlab:gitlab:8.17.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.4::~~community~~~ cpe:/a:gitlab:gitlab:8.17.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.5::~~community~~~ cpe:/a:gitlab:gitlab:8.17.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.6::~~community~~~ cpe:/a:gitlab:gitlab:8.17.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.7::~~community~~~ cpe:/a:gitlab:gitlab:8.17.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.17.8::~~community~~~ cpe:/a:gitlab:gitlab:8.17.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:8.18.0:-:~~community~~~ cpe:/a:gitlab:gitlab:8.18.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0::~~community~~~ cpe:/a:gitlab:gitlab:9.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.0.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:9.0.1::~~community~~~ cpe:/a:gitlab:gitlab:9.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.2::~~community~~~ cpe:/a:gitlab:gitlab:9.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.3::~~community~~~ cpe:/a:gitlab:gitlab:9.0.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.4::~~community~~~ cpe:/a:gitlab:gitlab:9.0.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.5::~~community~~~ cpe:/a:gitlab:gitlab:9.0.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.6::~~community~~~ cpe:/a:gitlab:gitlab:9.0.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.7::~~community~~~ cpe:/a:gitlab:gitlab:9.0.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.8::~~community~~~ cpe:/a:gitlab:gitlab:9.0.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.9::~~community~~~ cpe:/a:gitlab:gitlab:9.0.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.10::~~community~~~ cpe:/a:gitlab:gitlab:9.0.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.11::~~community~~~ cpe:/a:gitlab:gitlab:9.0.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.12::~~community~~~ cpe:/a:gitlab:gitlab:9.0.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.0.13::~~community~~~ cpe:/a:gitlab:gitlab:9.0.13::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.0::~~community~~~ cpe:/a:gitlab:gitlab:9.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.1.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:9.1.1::~~community~~~ cpe:/a:gitlab:gitlab:9.1.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.2::~~community~~~ cpe:/a:gitlab:gitlab:9.1.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.3::~~community~~~ cpe:/a:gitlab:gitlab:9.1.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.4::~~community~~~ cpe:/a:gitlab:gitlab:9.1.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.5::~~community~~~ cpe:/a:gitlab:gitlab:9.1.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.6::~~community~~~ cpe:/a:gitlab:gitlab:9.1.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.7::~~community~~~ cpe:/a:gitlab:gitlab:9.1.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.8::~~community~~~ cpe:/a:gitlab:gitlab:9.1.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.9::~~community~~~ cpe:/a:gitlab:gitlab:9.1.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.1.10::~~community~~~ cpe:/a:gitlab:gitlab:9.1.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.0::~~community~~~ cpe:/a:gitlab:gitlab:9.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.2.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:9.2.1::~~community~~~ cpe:/a:gitlab:gitlab:9.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.2::~~community~~~ cpe:/a:gitlab:gitlab:9.2.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.3::~~community~~~ cpe:/a:gitlab:gitlab:9.2.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.4::~~community~~~ cpe:/a:gitlab:gitlab:9.2.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.5::~~community~~~ cpe:/a:gitlab:gitlab:9.2.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.6::~~community~~~ cpe:/a:gitlab:gitlab:9.2.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.7::~~community~~~ cpe:/a:gitlab:gitlab:9.2.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.8::~~community~~~ cpe:/a:gitlab:gitlab:9.2.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.9::~~community~~~ cpe:/a:gitlab:gitlab:9.2.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.2.10::~~community~~~ cpe:/a:gitlab:gitlab:9.2.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.0::~~community~~~ cpe:/a:gitlab:gitlab:9.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.3.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:9.3.1::~~community~~~ cpe:/a:gitlab:gitlab:9.3.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.2::~~community~~~ cpe:/a:gitlab:gitlab:9.3.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.3::~~community~~~ cpe:/a:gitlab:gitlab:9.3.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.4::~~community~~~ cpe:/a:gitlab:gitlab:9.3.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.5::~~community~~~ cpe:/a:gitlab:gitlab:9.3.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.6::~~community~~~ cpe:/a:gitlab:gitlab:9.3.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.7::~~community~~~ cpe:/a:gitlab:gitlab:9.3.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.8::~~community~~~ cpe:/a:gitlab:gitlab:9.3.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.9::~~community~~~ cpe:/a:gitlab:gitlab:9.3.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.10::~~community~~~ cpe:/a:gitlab:gitlab:9.3.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.3.11::~~community~~~ cpe:/a:gitlab:gitlab:9.3.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.0::~~community~~~ cpe:/a:gitlab:gitlab:9.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.4.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.4.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:9.4.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.4.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.4.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.4.1::~~community~~~ cpe:/a:gitlab:gitlab:9.4.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.2::~~community~~~ cpe:/a:gitlab:gitlab:9.4.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.3::~~community~~~ cpe:/a:gitlab:gitlab:9.4.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.4::~~community~~~ cpe:/a:gitlab:gitlab:9.4.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.5::~~community~~~ cpe:/a:gitlab:gitlab:9.4.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.6::~~community~~~ cpe:/a:gitlab:gitlab:9.4.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.4.7::~~community~~~ cpe:/a:gitlab:gitlab:9.4.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.0::~~community~~~ cpe:/a:gitlab:gitlab:9.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:9.5.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:9.5.1::~~community~~~ cpe:/a:gitlab:gitlab:9.5.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.2::~~community~~~ cpe:/a:gitlab:gitlab:9.5.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.3::~~community~~~ cpe:/a:gitlab:gitlab:9.5.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.4::~~community~~~ cpe:/a:gitlab:gitlab:9.5.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.5::~~community~~~ cpe:/a:gitlab:gitlab:9.5.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.6::~~community~~~ cpe:/a:gitlab:gitlab:9.5.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.7::~~community~~~ cpe:/a:gitlab:gitlab:9.5.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.8::~~community~~~ cpe:/a:gitlab:gitlab:9.5.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.9::~~community~~~ cpe:/a:gitlab:gitlab:9.5.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.5.10::~~community~~~ cpe:/a:gitlab:gitlab:9.5.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:9.6.0:-:~~community~~~ cpe:/a:gitlab:gitlab:9.6.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0::~~community~~~ cpe:/a:gitlab:gitlab:10.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.0.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.0.1::~~community~~~ cpe:/a:gitlab:gitlab:10.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.2::~~community~~~ cpe:/a:gitlab:gitlab:10.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.3::~~community~~~ cpe:/a:gitlab:gitlab:10.0.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.4::~~community~~~ cpe:/a:gitlab:gitlab:10.0.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.5::~~community~~~ cpe:/a:gitlab:gitlab:10.0.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.0.6::~~community~~~ cpe:/a:gitlab:gitlab:10.0.7::~~community~~~ cpe:/a:gitlab:gitlab:10.0.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.0::~~community~~~ cpe:/a:gitlab:gitlab:10.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.1.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.1.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.1.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.1.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.1.1::~~community~~~ cpe:/a:gitlab:gitlab:10.1.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.2::~~community~~~ cpe:/a:gitlab:gitlab:10.1.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.3::~~community~~~ cpe:/a:gitlab:gitlab:10.1.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.4::~~community~~~ cpe:/a:gitlab:gitlab:10.1.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.5::~~community~~~ cpe:/a:gitlab:gitlab:10.1.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.6::~~community~~~ cpe:/a:gitlab:gitlab:10.1.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.1.7::~~community~~~ cpe:/a:gitlab:gitlab:10.1.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.0::~~community~~~ cpe:/a:gitlab:gitlab:10.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.2.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.2.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.2.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.2.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.2.1::~~community~~~ cpe:/a:gitlab:gitlab:10.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.2::~~community~~~ cpe:/a:gitlab:gitlab:10.2.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.3::~~community~~~ cpe:/a:gitlab:gitlab:10.2.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.4::~~community~~~ cpe:/a:gitlab:gitlab:10.2.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.5::~~community~~~ cpe:/a:gitlab:gitlab:10.2.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.6::~~community~~~ cpe:/a:gitlab:gitlab:10.2.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.7::~~community~~~ cpe:/a:gitlab:gitlab:10.2.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.2.8::~~community~~~ cpe:/a:gitlab:gitlab:10.2.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.0::~~community~~~ cpe:/a:gitlab:gitlab:10.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.3.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.3.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.3.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.3.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.3.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.3.1::~~community~~~ cpe:/a:gitlab:gitlab:10.3.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.2::~~community~~~ cpe:/a:gitlab:gitlab:10.3.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.3::~~community~~~ cpe:/a:gitlab:gitlab:10.3.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.4::~~community~~~ cpe:/a:gitlab:gitlab:10.3.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.5::~~community~~~ cpe:/a:gitlab:gitlab:10.3.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.6::~~community~~~ cpe:/a:gitlab:gitlab:10.3.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.7::~~community~~~ cpe:/a:gitlab:gitlab:10.3.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.8::~~community~~~ cpe:/a:gitlab:gitlab:10.3.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.3.9::~~community~~~ cpe:/a:gitlab:gitlab:10.3.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.0:-:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:10.4.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:10.4.1::~~community~~~ cpe:/a:gitlab:gitlab:10.4.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.2::~~community~~~ cpe:/a:gitlab:gitlab:10.4.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.3::~~community~~~ cpe:/a:gitlab:gitlab:10.4.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.4::~~community~~~ cpe:/a:gitlab:gitlab:10.4.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.5::~~community~~~ cpe:/a:gitlab:gitlab:10.4.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.6::~~community~~~ cpe:/a:gitlab:gitlab:10.4.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.4.7::~~community~~~ cpe:/a:gitlab:gitlab:10.4.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.0:-:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:10.5.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:10.5.1::~~community~~~ cpe:/a:gitlab:gitlab:10.5.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.2::~~community~~~ cpe:/a:gitlab:gitlab:10.5.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.3::~~community~~~ cpe:/a:gitlab:gitlab:10.5.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.4::~~community~~~ cpe:/a:gitlab:gitlab:10.5.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.5::~~community~~~ cpe:/a:gitlab:gitlab:10.5.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.6::~~community~~~ cpe:/a:gitlab:gitlab:10.5.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.7::~~community~~~ cpe:/a:gitlab:gitlab:10.5.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.5.8::~~community~~~ cpe:/a:gitlab:gitlab:10.5.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.0::~~community~~~ cpe:/a:gitlab:gitlab:10.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.6.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:10.6.1::~~community~~~ cpe:/a:gitlab:gitlab:10.6.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.2::~~community~~~ cpe:/a:gitlab:gitlab:10.6.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.3::~~community~~~ cpe:/a:gitlab:gitlab:10.6.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.4::~~community~~~ cpe:/a:gitlab:gitlab:10.6.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.5::~~community~~~ cpe:/a:gitlab:gitlab:10.6.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.6.6::~~community~~~ cpe:/a:gitlab:gitlab:10.6.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.0::~~community~~~ cpe:/a:gitlab:gitlab:10.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.7.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:10.7.1::~~community~~~ cpe:/a:gitlab:gitlab:10.7.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.2::~~community~~~ cpe:/a:gitlab:gitlab:10.7.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.3::~~community~~~ cpe:/a:gitlab:gitlab:10.7.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.4::~~community~~~ cpe:/a:gitlab:gitlab:10.7.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.5::~~community~~~ cpe:/a:gitlab:gitlab:10.7.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.6::~~community~~~ cpe:/a:gitlab:gitlab:10.7.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.7.7::~~community~~~ cpe:/a:gitlab:gitlab:10.7.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.0::~~community~~~ cpe:/a:gitlab:gitlab:10.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc11:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc12:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc13:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:10.8.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:10.8.1::~~community~~~ cpe:/a:gitlab:gitlab:10.8.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.2::~~community~~~ cpe:/a:gitlab:gitlab:10.8.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.3::~~community~~~ cpe:/a:gitlab:gitlab:10.8.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.4::~~community~~~ cpe:/a:gitlab:gitlab:10.8.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.5::~~community~~~ cpe:/a:gitlab:gitlab:10.8.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.6::~~community~~~ cpe:/a:gitlab:gitlab:10.8.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.8.7::~~community~~~ cpe:/a:gitlab:gitlab:10.8.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:10.9.0:-:~~community~~~ cpe:/a:gitlab:gitlab:10.9.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0::~~community~~~ cpe:/a:gitlab:gitlab:11.0.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc11:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc12:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc13:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc14:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:11.0.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:11.0.1::~~community~~~ cpe:/a:gitlab:gitlab:11.0.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.2::~~community~~~ cpe:/a:gitlab:gitlab:11.0.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.3::~~community~~~ cpe:/a:gitlab:gitlab:11.0.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.4::~~community~~~ cpe:/a:gitlab:gitlab:11.0.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.5::~~community~~~ cpe:/a:gitlab:gitlab:11.0.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.0.6::~~community~~~ cpe:/a:gitlab:gitlab:11.0.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.0::~~community~~~ cpe:/a:gitlab:gitlab:11.1.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.0:pre:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc11:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc12:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc13:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc14:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:11.1.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:11.1.1::~~community~~~ cpe:/a:gitlab:gitlab:11.1.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.2::~~community~~~ cpe:/a:gitlab:gitlab:11.1.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.3::~~community~~~ cpe:/a:gitlab:gitlab:11.1.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.4::~~community~~~ cpe:/a:gitlab:gitlab:11.1.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.5::~~community~~~ cpe:/a:gitlab:gitlab:11.1.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.6::~~community~~~ cpe:/a:gitlab:gitlab:11.1.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.7::~~community~~~ cpe:/a:gitlab:gitlab:11.1.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.1.8::~~community~~~ cpe:/a:gitlab:gitlab:11.1.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.0::~~community~~~ cpe:/a:gitlab:gitlab:11.2.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.1::~~community~~~ cpe:/a:gitlab:gitlab:11.2.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.2::~~community~~~ cpe:/a:gitlab:gitlab:11.2.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.3::~~community~~~ cpe:/a:gitlab:gitlab:11.2.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.4::~~community~~~ cpe:/a:gitlab:gitlab:11.2.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.5::~~community~~~ cpe:/a:gitlab:gitlab:11.2.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.6::~~community~~~ cpe:/a:gitlab:gitlab:11.2.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.7::~~community~~~ cpe:/a:gitlab:gitlab:11.2.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.2.8::~~community~~~ cpe:/a:gitlab:gitlab:11.2.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.0::~~community~~~ cpe:/a:gitlab:gitlab:11.3.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.1::~~community~~~ cpe:/a:gitlab:gitlab:11.3.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.2::~~community~~~ cpe:/a:gitlab:gitlab:11.3.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.3::~~community~~~ cpe:/a:gitlab:gitlab:11.3.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.4::~~community~~~ cpe:/a:gitlab:gitlab:11.3.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.5::~~community~~~ cpe:/a:gitlab:gitlab:11.3.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.6::~~community~~~ cpe:/a:gitlab:gitlab:11.3.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.7::~~community~~~ cpe:/a:gitlab:gitlab:11.3.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.8::~~community~~~ cpe:/a:gitlab:gitlab:11.3.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.9::~~community~~~ cpe:/a:gitlab:gitlab:11.3.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.10::~~community~~~ cpe:/a:gitlab:gitlab:11.3.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.11::~~community~~~ cpe:/a:gitlab:gitlab:11.3.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.12::~~community~~~ cpe:/a:gitlab:gitlab:11.3.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.13::~~community~~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.3.14::~~community~~~ cpe:/a:gitlab:gitlab:11.3.14::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4::~~community~~~ cpe:/a:gitlab:gitlab:11.4.0::~~community~~~ cpe:/a:gitlab:gitlab:11.4.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.1::~~community~~~ cpe:/a:gitlab:gitlab:11.4.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.2::~~community~~~ cpe:/a:gitlab:gitlab:11.4.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.3::~~community~~~ cpe:/a:gitlab:gitlab:11.4.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.4::~~community~~~ cpe:/a:gitlab:gitlab:11.4.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.5::~~community~~~ cpe:/a:gitlab:gitlab:11.4.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.6::~~community~~~ cpe:/a:gitlab:gitlab:11.4.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.7::~~community~~~ cpe:/a:gitlab:gitlab:11.4.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.8::~~community~~~ cpe:/a:gitlab:gitlab:11.4.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.9::~~community~~~ cpe:/a:gitlab:gitlab:11.4.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.10::~~community~~~ cpe:/a:gitlab:gitlab:11.4.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.11::~~community~~~ cpe:/a:gitlab:gitlab:11.4.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.12::~~community~~~ cpe:/a:gitlab:gitlab:11.4.12::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.13::~~community~~~ cpe:/a:gitlab:gitlab:11.4.13::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.4.14::~~community~~~ cpe:/a:gitlab:gitlab:11.4.14::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5::~~community~~~ cpe:/a:gitlab:gitlab:11.5.0::~~community~~~ cpe:/a:gitlab:gitlab:11.5.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:-:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:-:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc1:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc1:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc10:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc10:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc11:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc11:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc12:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc12:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc13:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc13:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc2:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc2:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc3:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc3:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc4:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc4:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc5:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc5:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc6:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc6:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc7:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc7:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc8:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc8:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.0:rc9:~~community~~~ cpe:/a:gitlab:gitlab:11.5.0:rc9:~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.1::~~community~~~ cpe:/a:gitlab:gitlab:11.5.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.2::~~community~~~ cpe:/a:gitlab:gitlab:11.5.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.3::~~community~~~ cpe:/a:gitlab:gitlab:11.5.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.5::~~community~~~ cpe:/a:gitlab:gitlab:11.5.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.8::~~community~~~ cpe:/a:gitlab:gitlab:11.5.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.9::~~community~~~ cpe:/a:gitlab:gitlab:11.5.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.10::~~community~~~ cpe:/a:gitlab:gitlab:11.5.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.5.11::~~community~~~ cpe:/a:gitlab:gitlab:11.5.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6::~~community~~~ cpe:/a:gitlab:gitlab:11.6.0::~~community~~~ cpe:/a:gitlab:gitlab:11.6.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.1::~~community~~~ cpe:/a:gitlab:gitlab:11.6.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.2::~~community~~~ cpe:/a:gitlab:gitlab:11.6.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.3::~~community~~~ cpe:/a:gitlab:gitlab:11.6.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.4::~~community~~~ cpe:/a:gitlab:gitlab:11.6.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.5::~~community~~~ cpe:/a:gitlab:gitlab:11.6.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.6::~~community~~~ cpe:/a:gitlab:gitlab:11.6.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.7::~~community~~~ cpe:/a:gitlab:gitlab:11.6.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.8::~~community~~~ cpe:/a:gitlab:gitlab:11.6.8::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.9::~~community~~~ cpe:/a:gitlab:gitlab:11.6.9::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.10::~~community~~~ cpe:/a:gitlab:gitlab:11.6.10::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.6.11::~~community~~~ cpe:/a:gitlab:gitlab:11.6.11::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7::~~community~~~ cpe:/a:gitlab:gitlab:11.7.0::~~community~~~ cpe:/a:gitlab:gitlab:11.7.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.1::~~community~~~ cpe:/a:gitlab:gitlab:11.7.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.2::~~community~~~ cpe:/a:gitlab:gitlab:11.7.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.3::~~community~~~ cpe:/a:gitlab:gitlab:11.7.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.4::~~community~~~ cpe:/a:gitlab:gitlab:11.7.4::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.5::~~community~~~ cpe:/a:gitlab:gitlab:11.7.5::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.6::~~community~~~ cpe:/a:gitlab:gitlab:11.7.6::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.7.7::~~community~~~ cpe:/a:gitlab:gitlab:11.7.7::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.8.0::~~community~~~ cpe:/a:gitlab:gitlab:11.8.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.8.1::~~community~~~ cpe:/a:gitlab:gitlab:11.8.1::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.8.2::~~community~~~ cpe:/a:gitlab:gitlab:11.8.2::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.8.3::~~community~~~ cpe:/a:gitlab:gitlab:11.8.3::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.9.0::~~community~~~ cpe:/a:gitlab:gitlab:11.9.0::~~enterprise~~~ cpe:/a:gitlab:gitlab:11.9.1::~~community~~~ cpe:/a:gitlab:gitlab:11.9.1::~~enterprise~~~

CVE-2019-10108

2019-05-15T16:29:00.243-04:00

2019-05-16T12:04:40.487-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-16T10:24:56.553-04:00

MISC https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/ MISC https://about.gitlab.com/blog/categories/releases/ MISC https://gitlab.com/gitlab-org/gitlab-ce/issues/56985 An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.