Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6026 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:24.365Z Vendors: MOTEX.Inc Products: Multiple MOTEX products Problem Types: Privilege escalation Description: Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScope Cat detection agent (DA) prior to Ver.9.2.1.0, LanScope Cat server monitoring agent (SA, SAE) prior to Ver.9.2.2.0, LanScope An prior to Ver 2.7.7.0 (LanScope An 2 series), and LanScope An prior to Ver 3.0.8.1 (LanScope An 3 series)) allow authenticated attackers to obtain unauthorized privileges and execute arbitrary code. Additional Analyst Not
ies)) allow authenticated attackers to obtain unauthorized privileges and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.motex.co.jp/news/news_topics/2019/release191202/ - http://jvn.jp/en/jp/JVN49068796/index.html
CVE ID: CVE-2019-6027 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:23.754Z Vendors: WP Spell Check Products: WP Spell Check Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-spell-check/ - http://jvn.jp/en/jp/JVN26838191/index.html
CVE ID: CVE-2019-6029 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:23.236Z Vendors: Andrei Lupu Products: Custom Body Class Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-custom-body-class/ - http://jvn.jp/en/jp/JVN26847507/index.html
CVE ID: CVE-2019-6030 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:24.283Z Vendors: Andrei Lupu Products: Custom Body Class Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-custom-body-class/ - http://jvn.jp/en/jp/JVN26847507/index.html
CVE ID: CVE-2019-6031 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:24.497Z Vendors: Dayz Inc. Products: KINZA Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via RSS reader. Additional Analyst Notes: - CVE Program Container: References: - https://www.kinza.jp/download/releases/ - http://jvn.jp/en/jp/JVN63047298/index.html
CVE ID: CVE-2019-6032 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:23.900Z Vendors: Nippon Television Network Corporation Products: NTV News24 Problem Types: Fails to verify SSL certificates Description: The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=jp.co.ntv.news24&hl=en - http://jvn.jp/en/jp/JVN01236065/index.html
CVE ID: CVE-2019-6033 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:24.521Z Vendors: appleple inc. Products: a-blog cms Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://developer.a-blogcms.jp/download/legacy.html - http://jvn.jp/en/jp/JVN10377257/index.html
CVE ID: CVE-2019-6034 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:23.649Z Vendors: appleple inc. Products: a-blog cms Problem Types: Script injection Description: a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be executed in the context of the application due to unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://developer.a-blogcms.jp/download/legacy.html - http://jvn.jp/en/jp/JVN10377257/index.html
CVE ID: CVE-2019-6035 State: PUBLISHED Published: 2019-12-26T15:16:50 Last Updated: 2024-08-04T20:16:23.962Z Vendors: Verison Media Products: Athenz Problem Types: Open Redirect Description: Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yahoo/athenz - https://github.com/yahoo/athenz/pull/700 - http://jvn.jp/en/jp/JVN57070811/index.html
CVE ID: CVE-2019-6036 State: PUBLISHED Published: 2020-01-27T09:35:26 Last Updated: 2024-08-04T20:16:24.288Z Vendors: ThinkingReed inc. Products: F-RevoCRM Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://f-revocrm.jp/2019/12/9393 - http://jvn.jp/en/jp/JVN97325754/index.html
CVE ID: CVE-2019-6109 State: PUBLISHED Published: 2019-01-31T00:00:00 Last Updated: 2024-08-04T20:16:24.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4387 - https://security.netapp.com/advisory/ntap-20190213-0001/ - https://c
: - https://www.debian.org/security/2019/dsa-4387 - https://security.netapp.com/advisory/ntap-20190213-0001/ - https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c - https://usn.ubuntu.com/3885-1/ - https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c - https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt - https://security.gentoo.org/glsa/201903-16 - https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html - https://www.oracle.com/technetwork/security-adv
://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3702 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2019-6110 State: PUBLISHED Published: 2019-01-31T00:00:00 Last Updated: 2024-08-04T20:16:24.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20190213-0001/ - https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c - https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c - https://sintonen.fi/advisories/scp-clien
sr.bin/ssh/scp.c - https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c - https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt - https://www.exploit-db.com/exploits/46193/ - https://security.gentoo.org/glsa/201903-16 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2019-6111 State: PUBLISHED Published: 2019-01-31T00:00:00 Last Updated: 2024-08-04T20:16:23.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to ov
irectory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4387 - https://security.netapp.com/advisory/ntap-20190213-0001/ - http://www.securityfocus.com/bid/106741 - https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c - https://usn.ubuntu.com/3885-1/ - https://usn.ubuntu.com/3885-2/ - https://bugzilla.redhat.com/show_bug.cgi?id=1677794 - https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt - https://www.exploit-db.com/exploits/46193/ - https://security.gentoo.org/glsa/2019
client-multiple-vulnerabilities.txt - https://www.exploit-db.com/exploits/46193/ - https://security.gentoo.org/glsa/201903-16 - https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html - http://www.openwall.com/lists/oss-security/2019/04/18/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/ - https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E - https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E - https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610
4d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E - https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html - https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc - https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3702 - http://www.openwall.com/lists/oss-security/2022/08/02/1 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pd
http://www.openwall.com/lists/oss-security/2022/08/02/1 - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2019-6112 State: PUBLISHED Published: 2020-08-14T13:42:24 Last Updated: 2024-08-04T20:16:23.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field). Additional Analyst Notes: - CVE Program Container: References: - https://metamorfosec.com/Files/Advisories/METS-2020-001-A_XSS_Vulnerability_in_Sell_Media_Plugin_v2.4.1_for_WordPress.txt - https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f
for_WordPress.txt - https://github.com/graphpaperpress/Sell-Media/commit/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b
CVE ID: CVE-2019-6113 State: PUBLISHED Published: 2019-08-29T21:13:30 Last Updated: 2024-08-04T20:16:24.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot) and %2f to the default URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.contextis.com/en/resources/advisories/cve-2019-6113
CVE ID: CVE-2019-6114 State: PUBLISHED Published: 2019-06-19T15:56:24 Last Updated: 2024-08-04T20:16:23.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Corel PaintShop Pro 2019 21.0.0.119. An integer overflow in the jp2 parsing library allows an attacker to overwrite memory and to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ereisr00/bagofbugz/tree/master/CorelPaintShop2019
CVE ID: CVE-2019-6116 State: PUBLISHED Published: 2019-03-19T18:27:21 Last Updated: 2024-08-04T20:16:23.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0229 - http://www.securityfocus.com/bid/106700 - https://usn.ubuntu.com/3866-1/ - https://www.exploit-db.com/exploits/46242/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00016.html - http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-E
s-announce/2019/02/msg00016.html - http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html - https://www.debian.org/security/2019/dsa-4372 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1729 - http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-01/msg00048.html - http://www.openwall.com/lists/oss-security/2019/01/23/5 - https://bugs.ghostscript.com/show_bug.cgi?id=700317 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWVAVCDXBLPLJMVGNSKGGDTBEOHCJBKK/ - https://lists.fedoraproject.org/archives/list/packag
lists.fedoraproject.org/message/MWVAVCDXBLPLJMVGNSKGGDTBEOHCJBKK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N6T5L3SSJX2AVUPHP7GCPATFWUPKZT2/ - http://www.openwall.com/lists/oss-security/2019/03/21/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVWXVKG72IGEJYHLWE6H3CGALHGFSGGY/ - https://seclists.org/bugtraq/2019/Apr/4 - http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html - https://access.redhat.com/errata/RHBA-2019:0327 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLS
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/ - https://security.gentoo.org/glsa/202004-03
CVE ID: CVE-2019-6117 State: PUBLISHED Published: 2019-04-09T17:51:25 Last Updated: 2024-08-04T20:16:24.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function. Additional Analyst Notes: - CVE Program Container: References: - https://earthmanet.github.io/2019/01/05/Wordpress%20plugin%20Gallery%20Images%20Ape%201.6.14-Stored%20Cross-Site%20Scripting/
CVE ID: CVE-2019-6120 State: PUBLISHED Published: 2019-11-06T17:12:05 Last Updated: 2024-08-04T20:16:24.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit - https://cyberworldm
References: - https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit - https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
CVE ID: CVE-2019-6121 State: PUBLISHED Published: 2019-11-06T17:17:03 Last Updated: 2024-08-04T20:16:24.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as his recent payments, unclaimed Balance, Old Balance (at the time of December 2017 breach) , Projected payout, Mining stats like profitability, Efficiency, Number of workers, etc.. A valid Email address is required in order to retrieve this Information. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8
dditional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit - https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
CVE ID: CVE-2019-6122 State: PUBLISHED Published: 2019-11-06T17:19:01 Last Updated: 2024-08-04T20:16:23.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit - https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
CVE ID: CVE-2019-6126 State: PUBLISHED Published: 2019-01-11T05:00:00 Last Updated: 2024-08-04T20:16:24.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mad-robot/CVE-List/blob/master/Advance%20Peer%20to%20Peer%20MLM%20Script.md
CVE ID: CVE-2019-6127 State: PUBLISHED Published: 2019-01-11T05:00:00Z Last Updated: 2024-09-17T01:46:23.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Eas3n/Vulnerabilities/blob/master/XiaoCMS_20141229_GETSHELL.md
CVE ID: CVE-2019-6128 State: PUBLISHED Published: 2019-01-11T05:00:00 Last Updated: 2024-08-04T20:16:23.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3906-1/ - http://bugzilla.maptools.org/show_bug.cgi?id=2836 - https://usn.ubuntu.com/3906-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00041.html - https://gitlab.com/libtiff/libtiff/commit/0c74a9f49b8d7a36b17b54a7428b3526d20f88a8 - https://seclists.org/bugtraq/2019/Nov/5 - http://packetstormsecurity.com/files/15509
49b8d7a36b17b54a7428b3526d20f88a8 - https://seclists.org/bugtraq/2019/Nov/5 - http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00027.html - https://security.gentoo.org/glsa/202003-25
CVE ID: CVE-2019-6129 State: PUBLISHED Published: 2019-01-11T05:00:00 Last Updated: 2024-08-04T20:16:24.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glennrp/libpng/issues/269 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2019-6130 State: PUBLISHED Published: 2019-01-11T05:00:00 Last Updated: 2024-09-11T15:56:35.805877 Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=700446 - http://www.securityfocus.com/bid/106558 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.
list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY/ - https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=faf47b94e24314d74907f3f6bc874105f2c962ed
CVE ID: CVE-2019-6131 State: PUBLISHED Published: 2019-01-11T05:00:00 Last Updated: 2024-09-11T15:59:51.603081 Vendors: n/a Products: n/a Problem Types: n/a Description: svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=700442 - http://www.securityfocus.com/bid/106558 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY/ - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b
CVE ID: CVE-2019-6132 State: PUBLISHED Published: 2019-01-11T05:00:00Z Last Updated: 2024-09-17T04:19:21.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 v1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp when called from the AP4_EsdsAtom class in Core/Ap4EsdsAtom.cpp, as demonstrated by mp42aac. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/357