From 3c8ec933e72bed5551fa7290c371ff28725148d0 Mon Sep 17 00:00:00 2001 From: Noam Rathaus Date: Thu, 1 Apr 2021 17:09:29 +0300 Subject: [PATCH 1/2] Description --- cves/2019/CVE-2019-17382.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cves/2019/CVE-2019-17382.yaml b/cves/2019/CVE-2019-17382.yaml index 793360a6ef..c3613b4bae 100644 --- a/cves/2019/CVE-2019-17382.yaml +++ b/cves/2019/CVE-2019-17382.yaml @@ -4,7 +4,8 @@ info: name: Zabbix Authentication Bypass author: Harsh Bothra severity: critical - reference: https://nvd.nist.gov/vuln/detail/CVE-2019-17382 + description: An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password (i.e., anonymously). All created elements (Dashboard/Report/Screen/Map) are accessible by other users and by an admin. + reference: https://www.exploit-db.com/exploits/47467 tags: cve,cve2019,zabbix requests: From 198e192137a236306dc2908aba7d9cfe39620f49 Mon Sep 17 00:00:00 2001 From: Noam Rathaus Date: Thu, 1 Apr 2021 17:16:07 +0300 Subject: [PATCH 2/2] Description --- cves/2019/CVE-2019-11869.yaml | 2 +- cves/2019/CVE-2019-14205.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/cves/2019/CVE-2019-11869.yaml b/cves/2019/CVE-2019-11869.yaml index 508c96e9e2..750761d05d 100644 --- a/cves/2019/CVE-2019-11869.yaml +++ b/cves/2019/CVE-2019-11869.yaml @@ -12,7 +12,7 @@ info: a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting. - References: + reference: | - https://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild - https://wpscan.com/vulnerability/9254 tags: cve,cve2019,wordpress,wp-plugin,xss diff --git a/cves/2019/CVE-2019-14205.yaml b/cves/2019/CVE-2019-14205.yaml index 8962657096..05fcd12672 100644 --- a/cves/2019/CVE-2019-14205.yaml +++ b/cves/2019/CVE-2019-14205.yaml @@ -4,6 +4,7 @@ info: author: pikpikcu severity: high tags: cve,cve2019,wordpress,wp-plugin,lfi + description: A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php. reference: https://github.com/security-kma/EXPLOITING-CVE-2019-14205 requests: