Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-19799 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T11:44:20.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://pentest.com.tr/exploits/Dolibarr-ERP-CRM-8-0-3-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/45945/ - http://packetstormsecurity.com/files/150623/Dolibarr-ERP-CRM-8.0.3-Cross-Site-Scripting.html
CVE ID: CVE-2018-19800 State: PUBLISHED Published: 2019-06-07T16:38:27 Last Updated: 2024-08-05T11:44:20.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/blob/0.4.9/ChangeLog - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYIKPYXZIWYWWNNORSKWRCFFCP6AFMRZ/ - https://lists.fedoraproject.org/archives/list/package-announ
doraproject.org/message/IYIKPYXZIWYWWNNORSKWRCFFCP6AFMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHIRMWW4JQ6UHJK4AVBJLFRLE2TPKC2W/
CVE ID: CVE-2018-19801 State: PUBLISHED Published: 2019-06-07T16:37:38 Last Updated: 2024-08-05T11:44:20.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/blob/0.4.9/ChangeLog - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYIKPYXZIWYWWNNORSKWRCFFCP6AFMRZ/ - https://lists.fedoraproj
ves/list/package-announce%40lists.fedoraproject.org/message/IYIKPYXZIWYWWNNORSKWRCFFCP6AFMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHIRMWW4JQ6UHJK4AVBJLFRLE2TPKC2W/
CVE ID: CVE-2018-19802 State: PUBLISHED Published: 2019-06-07T16:35:47 Last Updated: 2024-08-05T11:44:20.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aubio/aubio/blob/0.4.9/ChangeLog - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00003.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYIKPYXZIWYWW
03.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYIKPYXZIWYWWNNORSKWRCFFCP6AFMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHIRMWW4JQ6UHJK4AVBJLFRLE2TPKC2W/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00012.html
CVE ID: CVE-2018-19809 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/GroupCopy.jsp" has reflected XSS via the ConnPoolName, GroupId, or type parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19810 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/GroupMove.jsp" has reflected XSS via the ConnPoolName, GroupId, or type parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19811 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Import.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19812 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SubFolderPackages.jsp" has reflected XSS via the GroupId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19813 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscribers.jsp" has reflected XSS via the ConnPoolName or GroupId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19814 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Subscriptions.jsp" has reflected XSS via the ConnPoolName or GroupId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19815 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/UserPopupAddNewProp.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19816 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/categorytree/ChooseCategory.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19817 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/AdminAuthorisationFrame.jsp" has reflected XSS via the ConnPoolName or GroupId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19818 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Contacts.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19819 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Rights.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19820 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/Roles.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19821 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SecurityPolicies.jsp" has reflected XSS via the ConnPoolName parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19822 State: PUBLISHED Published: 2018-12-17T15:00:00 Last Updated: 2024-08-05T11:44:20.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting exists in InfoVista VistaPortal SE Version 5.1 (build 51029). The page "/VPortal/mgtconsole/SharedCriteria.jsp" has reflected XSS via the ConnPoolName or GroupId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150690/VistaPortal-SE-5.1-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2018/Dec/20
CVE ID: CVE-2018-19824 State: PUBLISHED Published: 2018-12-03T17:00:00 Last Updated: 2024-08-05T11:44:20.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/5f8cf712582617d523120df67d392059eaf2fc4b - https://bugzilla.suse.com/show_bug.cgi?id=1118152 - https://usn.ubuntu.com/3879-2/ - https://usn.ubuntu.com/3879-1/ - https://git.kernel.org/pub/scm/linux/kern
id=1118152 - https://usn.ubuntu.com/3879-2/ - https://usn.ubuntu.com/3879-1/ - https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=5f8cf712582617d523120df67d392059eaf2fc4b - http://www.securityfocus.com/bid/106109 - https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html - https://support.f5.com/csp/article/K98155950 - https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html - https://usn.ubuntu.com/3930-1/ - https://usn.ubuntu.com/3931-1/ - https://usn.ubuntu.com/3933-2/ - https://usn.ubuntu.com/3931-2/ - https://usn.ubuntu.com/3930-2/ - https://usn.ubuntu.com/3933-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html - https://a
930-2/ - https://usn.ubuntu.com/3933-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html - https://access.redhat.com/errata/RHSA-2019:2703
CVE ID: CVE-2018-19826 State: PUBLISHED Published: 2018-12-03T19:00:00 Last Updated: 2024-08-05T11:44:20.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2781
CVE ID: CVE-2018-19827 State: PUBLISHED Published: 2018-12-03T19:00:00 Last Updated: 2024-08-05T11:44:20.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2782 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/
ts.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2018-19828 State: PUBLISHED Published: 2018-12-17T18:00:00 Last Updated: 2024-08-05T11:44:20.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Integria IMS 5.0.83 has XSS via the search_string parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-19828-integria-ims-5-0-83-cross-site-scripting-reflejado/ - https://www.exploit-db.com/exploits/46012/
CVE ID: CVE-2018-19829 State: PUBLISHED Published: 2018-12-18T22:00:00 Last Updated: 2024-08-05T11:44:20.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-19829-integria-ims-5-0-83-cross-site-request-forgery/ - https://www.exploit-db.com/exploits/46013/
CVE ID: CVE-2018-19830 State: PUBLISHED Published: 2019-12-31T15:06:32 Last Updated: 2024-08-05T11:44:20.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public (by default) and does not check the caller's identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19
/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE ID: CVE-2018-19831 State: PUBLISHED Published: 2019-12-31T15:06:41 Last Updated: 2024-08-05T11:44:20.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%2
one%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE ID: CVE-2018-19832 State: PUBLISHED Published: 2019-12-31T15:06:37 Last Updated: 2024-08-05T11:44:20.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20C
e%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE ID: CVE-2018-19833 State: PUBLISHED Published: 2019-12-31T15:06:46 Last Updated: 2024-08-05T11:44:20.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE
%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE ID: CVE-2018-19834 State: PUBLISHED Published: 2019-12-31T15:06:29 Last Updated: 2024-08-05T11:44:20.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SmartContractResearcher/SmartContractSecurity/blob/master/New%20Vulnerabilities%20Allow%20Anyone%20to%20Own%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-198
n%20Certain%20ERC20-Based%20Smart%20Contracts%28CVE-2018-19830%2C%20CVE-2018-19831%2C%20CVE-2018-19832%2C%20CVE-2018-19833%2C%20CVE-2018-19834%29/README.md
CVE ID: CVE-2018-19835 State: PUBLISHED Published: 2018-12-03T19:00:00 Last Updated: 2024-08-05T11:44:20.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo 6.1.3 has reflected XSS via the admin/column/move.php lang_columnerr4 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/imagemlt/metinfo/tree/master/reflected_xss_bypass_chrome
CVE ID: CVE-2018-19836 State: PUBLISHED Published: 2018-12-03T19:00:00 Last Updated: 2024-08-05T11:44:20.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering variables from the $_COOKIE value. This issue can, for example, be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/imagemlt/metinfo/tree/master/reflected_xss_bypass_chrome
CVE ID: CVE-2018-19837 State: PUBLISHED Published: 2018-12-04T09:00:00 Last Updated: 2024-08-05T11:44:20.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2659 - https://github.com/sass/libsass/commit/210fdff7a65370c2ae24e022a2b35da8c423cc5f - http://lists.opensuse.org/opensuse-security-announce/2019-07/m
libsass/commit/210fdff7a65370c2ae24e022a2b35da8c423cc5f - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2018-19838 State: PUBLISHED Published: 2018-12-04T09:00:00 Last Updated: 2024-08-05T11:44:20.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2660 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg000
g/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2018-19839 State: PUBLISHED Published: 2018-12-04T09:00:00 Last Updated: 2024-08-05T11:44:20.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/pull/2767 - https://github.com/sass/libsass/issues/2657 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensus
47.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2018-19840 State: PUBLISHED Published: 2018-12-04T09:00:00 Last Updated: 2024-08-05T11:44:20.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/53 - https://github.com/dbry/WavPack/commit/070ef6f138956d9ea9612e69586152339dbefe51 - https://usn.ubuntu.com/3839-1/ - http://lists.opensuse.org/ope