Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/FasterXML/ja
curity-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/FasterXML/jackson-databind/issues/2526 - https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2 - https://security.netapp.com/advisory/ntap-20200127-0004/ - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-20334 State: PUBLISHED Published: 2020-01-04T06:43:42 Last Updated: 2024-08-05T02:39:09.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392638 - https://bugzilla.nasm.us/show_bug.cgi?id=3392548#c4
CVE ID: CVE-2019-20336 State: PUBLISHED Published: 2020-01-05T21:06:57 Last Updated: 2024-08-05T02:39:09.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mad-robot/CVE-List/blob/master/Advanced%20Real%20Estate%20Script.md
CVE ID: CVE-2019-20337 State: PUBLISHED Published: 2020-01-05T21:06:40 Last Updated: 2024-08-05T02:39:09.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mad-robot/CVE-List/blob/master/Advanced%20Real%20Estate%20Script.md
CVE ID: CVE-2019-20343 State: PUBLISHED Published: 2020-01-06T13:46:30 Last Updated: 2024-08-05T02:39:09.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary command-line arguments in an arguments element). Additional Analyst Notes: - CVE Program Container: References: - https://www.mojohaus.org/exec-maven-plugin/ - https://drive.google.com/open?id=0B5UvrSwn4wuwTnNqSzZESjIwZHo5ZXhWdHh2T2Z0eWRCT1hF - https://drive.google.com/open?id=1GLs0d9IG
/drive.google.com/open?id=0B5UvrSwn4wuwTnNqSzZESjIwZHo5ZXhWdHh2T2Z0eWRCT1hF - https://drive.google.com/open?id=1GLs0d9IGArMVrlbEGbxgCjA1MuzIJk-3
CVE ID: CVE-2019-20348 State: PUBLISHED Published: 2020-01-06T20:31:13 Last Updated: 2024-08-05T02:39:09.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tanprathan/24cab2eb02937f86961c6380b47ce385
CVE ID: CVE-2019-20352 State: PUBLISHED Published: 2020-01-06T05:05:20 Last Updated: 2024-08-05T02:39:09.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392636
CVE ID: CVE-2019-20354 State: PUBLISHED Published: 2020-01-06T05:53:46 Last Updated: 2024-08-05T02:39:09.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/colloqi/piSignage/issues/97 - https://github.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.md - http://packetstormsecurity.com/files/155864/piSignage-2.6.4-Dire
.com/colloqi/piSignage/blob/master/RELEASE%20NOTES.md - http://packetstormsecurity.com/files/155864/piSignage-2.6.4-Directory-Traversal.html
CVE ID: CVE-2019-20357 State: PUBLISHED Published: 2020-01-17T23:45:25 Last Updated: 2024-08-05T02:39:09.456Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Persistent Arbitrary Code Execution Description: A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124099.aspx - http://hyp3rlinx.alt
er: References: - https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124099.aspx - http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt - https://seclists.org/bugtraq/2020/Jan/28
CVE ID: CVE-2019-20358 State: PUBLISHED Published: 2020-01-30T21:10:14 Last Updated: 2024-08-05T02:39:09.497Z Vendors: Trend Micro Products: Trend Micro Anti-Threat Toolkit (ATTK) Problem Types: Arbitrary RCE Description: Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed. Another attack vector similar to CVE-2019-9491 was idenitfied and resolved in version 1.62.0.1228 of the tool. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000149878 - https://
ional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000149878 - https://seclists.org/bugtraq/2020/Jan/55 - http://seclists.org/fulldisclosure/2020/Jan/50
CVE ID: CVE-2019-20360 State: PUBLISHED Published: 2020-01-08T05:03:09 Last Updated: 2024-08-05T02:39:09.092Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access
the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9889 - https://www.wordfence.com/blog/2019/09/authentication-bypass-vulnerability-in-givewp-plugin/
CVE ID: CVE-2019-20361 State: PUBLISHED Published: 2020-01-08T05:03:21 Last Updated: 2024-08-05T02:39:09.761Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability). Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9947 - https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/ - http://packetstormsecurity.com
/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/ - http://packetstormsecurity.com/files/158568/WordPress-Email-Subscribers-And-Newsletters-4.2.2-SQL-Injection.html
CVE ID: CVE-2019-20362 State: PUBLISHED Published: 2020-01-08T14:05:15 Last Updated: 2024-08-05T02:39:09.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of %PROGRAMFILES(X86)%\Teradici\PCoIP.exe instead of the intended pcoip_vchan_printing_svc.exe file. Additional Analyst Notes: - CVE Program Container: References: - https://help.teradici.com/s/article/unquoted-service-path-vulnerability-windows-agent-client-19-08-earlier
CVE ID: CVE-2019-20363 State: PUBLISHED Published: 2020-01-08T16:27:50 Last Updated: 2024-08-05T02:39:09.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents. Additional Analyst Notes: - CVE Program Container: References: - https://issues.igniterealtime.org/browse/OF-1955 - https://github.com/igniterealtime/Openfire/pull/1561 - https://cybersecurityworks.com/zerodays/cve-2019-20363-openfire.html
CVE ID: CVE-2019-20364 State: PUBLISHED Published: 2020-01-08T16:27:41 Last Updated: 2024-08-05T02:39:09.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp. Additional Analyst Notes: - CVE Program Container: References: - https://issues.igniterealtime.org/browse/OF-1955 - https://github.com/igniterealtime/Openfire/pull/1561 - https://cybersecurityworks.com/zerodays/cve-2019-20364-openfire.html
CVE ID: CVE-2019-20365 State: PUBLISHED Published: 2020-01-08T16:27:14 Last Updated: 2024-08-05T02:39:09.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page. Additional Analyst Notes: - CVE Program Container: References: - https://issues.igniterealtime.org/browse/OF-1955 - https://github.com/igniterealtime/Openfire/pull/1561 - https://cybersecurityworks.com/zerodays/cve-2019-20365-openfire.html
CVE ID: CVE-2019-20366 State: PUBLISHED Published: 2020-01-08T16:26:28 Last Updated: 2024-08-05T02:39:09.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents. Additional Analyst Notes: - CVE Program Container: References: - https://issues.igniterealtime.org/browse/OF-1955 - https://github.com/igniterealtime/Openfire/pull/1561 - https://cybersecurityworks.com/zerodays/cve-2019-20366-openfire.html
CVE ID: CVE-2019-20367 State: PUBLISHED Published: 2020-01-08T16:50:03 Last Updated: 2024-08-05T02:39:09.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). Additional Analyst Notes: - CVE Program Container: References: - https://lists.freedesktop.org/archives/libbsd/2019-August/000229.html - https://gitlab.freedesktop.org/libbsd/libbsd/commit/9d917aad37778a9f4a96ba358415f077f3f36f3b - https://usn.ubuntu.com/4243-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00043.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00027
use.org/opensuse-security-announce/2020-05/msg00043.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00027.html - https://lists.apache.org/thread.html/ra781e51cf1ec40381c98cddc073b3576fb56c3978f4564d2fa431550%40%3Cdev.tomee.apache.org%3E - https://lists.apache.org/thread.html/r0e913668380f59bcbd14fdd8ae8d24f95f99995e290cd18a7822c6e5%40%3Cdev.tomee.apache.org%3E
CVE ID: CVE-2019-20372 State: PUBLISHED Published: 2020-01-09T20:05:38 Last Updated: 2024-08-05T02:39:09.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. Additional Analyst Notes: - CVE Program Container: References: - https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf - http://nginx.org/en/CHANGES - https://duo.com/docs/dng-notes#version-1.5.4-january-2020 - https://github.com/kubernetes/ingress-nginx/pull/4859
NGES - https://duo.com/docs/dng-notes#version-1.5.4-january-2020 - https://github.com/kubernetes/ingress-nginx/pull/4859 - https://github.com/nginx/nginx/commit/c1be55f97211d38b69ac0c2027e6812ab8b1b94e - https://usn.ubuntu.com/4235-1/ - https://usn.ubuntu.com/4235-2/ - https://security.netapp.com/advisory/ntap-20200127-0003/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.html - https://support.apple.com/kb/HT212818 - http://seclists.org/fulldisclosure/2021/Sep/36
CVE ID: CVE-2019-20373 State: PUBLISHED Published: 2020-01-09T22:27:55 Last Updated: 2024-08-05T02:39:09.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script. Additional Analyst Notes: - CVE Program Container: References: - https://git.launchpad.net/~ltsp-upstream/ltsp/+git/ldm/commit/?id=c351ac69ef63ed6c84221cef73e409059661b8ba - https://www.debian.org/security/2020/dsa-4601 - https://lists.debian.org/debian-lts-announce/2020/01/msg00007.html
CVE ID: CVE-2019-20374 State: PUBLISHED Published: 2020-01-09T22:40:29 Last Updated: 2024-08-05T02:39:09.856Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment. Additional Analyst
sed on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typora/typora-issues/issues/3124 - https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e
CVE ID: CVE-2019-20375 State: PUBLISHED Published: 2020-01-10T04:52:20 Last Updated: 2024-08-05T02:39:09.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/ritt/elog/commits/eefdabb714f26192f585083ef96c8413e459a1d1
CVE ID: CVE-2019-20376 State: PUBLISHED Published: 2020-01-10T04:52:05 Last Updated: 2024-08-05T02:39:09.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/ritt/elog/commits/993bed4923c88593cc6b1186e0d1b9564994a25a
CVE ID: CVE-2019-20377 State: PUBLISHED Published: 2020-01-11T03:01:10 Last Updated: 2024-08-05T02:39:09.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: TopList before 2019-09-03 allows XSS via a title. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tophubs/TopList/issues/32
CVE ID: CVE-2019-20378 State: PUBLISHED Published: 2020-01-11T03:01:00 Last Updated: 2024-08-05T02:39:09.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ganglia/ganglia-web/issues/351
CVE ID: CVE-2019-20379 State: PUBLISHED Published: 2020-01-11T03:00:51 Last Updated: 2024-08-05T02:39:09.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ganglia/ganglia-web/issues/351
CVE ID: CVE-2019-20381 State: PUBLISHED Published: 2020-01-20T05:21:28 Last Updated: 2024-08-05T02:39:09.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491. Additional Analyst Notes: - CVE Program Container: References: - http://mantis.testlink.org/view.php?id=8808 - https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/cde692895e425731e6951d265a01ca6425a7c26e - https://github.com/TestLinkOpenSourceTRMS/testlink-code/compare/1.9.19...1.9.20
CVE ID: CVE-2019-20382 State: PUBLISHED Published: 2020-03-05T18:27:21 Last Updated: 2024-08-05T02:39:09.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. Additional Analyst Notes: - CVE Program Container: References: - https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0 - http://www.openwall.com/lists/oss-security/2020/03/05/1 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html - https://www.debia
s-security/2020/03/05/1 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html - https://www.debian.org/security/2020/dsa-4665 - https://usn.ubuntu.com/4372-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
CVE ID: CVE-2019-20383 State: PUBLISHED Published: 2020-08-13T22:51:07 Last Updated: 2024-08-05T02:39:09.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links. Additional Analyst Notes: - CVE Program Container: References: - https://support.abbyy.com/hc/en-us/articles/360008536920-FineReader-15-Change-Log - https://amonitoring.ru/article/abbyy-lpe/ - http://www.abbyydownloads.com/fc12/r3/ReleaseNotes_FC12_R3_U1_1299.39_build_12.0.3.2634.pdf
CVE ID: CVE-2019-20384 State: PUBLISHED Published: 2020-01-20T23:52:47 Last Updated: 2024-08-05T02:39:09.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/692492 - http://www.openwall.com/lists/oss-security/2020/01/21/1
CVE ID: CVE-2019-20385 State: PUBLISHED Published: 2020-01-21T00:37:02 Last Updated: 2024-08-05T02:39:09.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://xpl0ited.blogspot.com/2019/11/unrestricted-file-upload-at-logaritmo.html
CVE ID: CVE-2019-20386 State: PUBLISHED Published: 2020-01-21T05:12:30.000Z Last Updated: 2025-06-09T15:40:54.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/systemd/systemd/commit/b2774a3ae692113e1f47a336a6c09bac9cfb49ad - https://security.netapp.com/advisory/ntap-20200210-0002/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00014.html - https://usn.ubuntu.com/4269-1/ - https://lists.fedoraprojec
nsuse.org/opensuse-security-announce/2020-02/msg00014.html - https://usn.ubuntu.com/4269-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZPCOMW5X6IZZXASCDD2CNW2DLF3YADC/
CVE ID: CVE-2019-20387 State: PUBLISHED Published: 2020-01-21T22:54:05 Last Updated: 2024-08-05T02:39:09.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openSUSE/libsolv/commit/fdb9c9c03508990e4583046b590c30d958f272da - https://github.com/openSUSE/libsolv/compare/0.7.5...0.7.6 - https://lists.debian.org/debian-lts-announce/2020/01/msg00034.html
CVE ID: CVE-2019-20388 State: PUBLISHED Published: 2020-01-21T22:53:50 Last Updated: 2024-08-05T02:39:09.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3A
CIWKJVRV6YAWI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68 - https://security.netapp.com/advisory/ntap-20200702-0005/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html - https://security.gentoo.org/glsa/202010-04 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html