deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-20796
Published: 2019-02-26
Description: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://www.securityfocus.com/bid/107160; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141; https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
CVE: CVE-2019-9169
Published: 2019-02-26
Description: In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/107160; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
CVE: CVE-2019-9181
Published: 2019-02-26
Description: SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://www.iwantacve.cn/index.php/archives/125/; http://www.iwantacve.cn/index.php/archives/125/
CVE: CVE-2019-9182
Published: 2019-02-26
Description: There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.iwantacve.cn/index.php/archives/119/; https://packetstorm.news/files/id/151967; https://www.exploit-db.com/exploits/46488
CVE: CVE-2019-6592
Published: 2019-02-26
Description: On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: http://www.securityfocus.com/bid/107176; https://support.f5.com/csp/article/K54167061; http://www.securityfocus.com/bid/107176
CVE: CVE-2019-6593
Published: 2019-02-26
Description: On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://support.f5.com/csp/article/K10065173; https://support.f5.com/csp/article/K10065173
CVE: CVE-2019-6594
Published: 2019-02-26
Description: On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-835
References: https://support.f5.com/csp/article/K91026261; https://support.f5.com/csp/article/K91026261
CVE: CVE-2019-6595
Published: 2019-02-26
Description: Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107173; https://support.f5.com/csp/article/K31424926; http://www.securityfocus.com/bid/107173
CVE: CVE-2019-9184
Published: 2019-02-26
Description: SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://andreiconache.me/j2store-plugin-3-3-6-sql-injection/; https://www.exploit-db.com/exploits/46467/; https://www.j2store.org/blog/general/security-update-for-j2store.html
CVE: CVE-2019-7392
Published: 2019-02-26
Description: An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/107040; https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190212-01--security-notice-for-ca-privileged-access-manager.html; http://www.securityfocus.com/bid/107040
CVE: CVE-2019-9191
Published: 2019-02-26
Description: The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide per-session forward secrecy.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/107208; https://www.eff.org/deeplinks/2019/02/ets-isnt-tls-and-you-shouldnt-use-it; http://www.securityfocus.com/bid/107208
CVE: CVE-2019-9192
Published: 2019-02-26
Description: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://sourceware.org/bugzilla/show_bug.cgi?id=24269; https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS; https://sourceware.org/bugzilla/show_bug.cgi?id=24269
CVE: CVE-2019-9194
Published: 2019-02-26
Description: elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Studio-42/elFinder/blob/master/README.md; https://github.com/Studio-42/elFinder/compare/6884c4f...0740028; https://github.com/Studio-42/elFinder/releases/tag/2.1.48
CVE: CVE-2019-9195
Published: 2019-02-26
Description: util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/mimblewimble/grin/pull/2624; https://github.com/mimblewimble/grin/releases/tag/v1.0.2; https://www.grin-forum.org/t/critical-vulnerability-in-grin-1-0-1-and-older-fixed-in-1-0-2/4343
CVE: CVE-2019-9199
Published: 2019-02-26
Description: PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://github.com/jjanku/podofo/commit/ada821df68fb0bf673840ed525daf4ec709dbfd9; https://github.com/mksdev/podofo/commit/1400a9aaf611299b9a56aa2abeb158918b9743c8; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/
CVE: CVE-2019-9200
Published: 2019-02-26
Description: A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/107172; https://access.redhat.com/errata/RHSA-2019:2022; https://access.redhat.com/errata/RHSA-2019:2713
CVE: CVE-2019-9201
Published: 2019-02-26
Description: Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert.vde.com/en/advisories/VDE-2019-015/; https://medium.com/%40SergiuSechel/misconfiguration-in-ilc-gsm-gprs-devices-leaves-over-1-200-ics-devices-vulnerable-to-attacks-over-82c2d4a91561; https://cert.vde.com/en/advisories/VDE-2019-015/
CVE: CVE-2019-7006
Published: 2019-02-27
Description: Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327
References: http://www.securityfocus.com/bid/107175; https://downloads.avaya.com/css/P8/documents/101055601; https://downloads.avaya.com/css/P8/documents/101055661
CVE: CVE-2019-9210
Published: 2019-02-27
Description: In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-190
References: https://lists.debian.org/debian-lts-announce/2019/03/msg00004.html; https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R56LVWC7KUNXFRKQB3Y5NX2YHFJKYZB4/
CVE: CVE-2018-20797
Published: 2019-02-27
Description: An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in base/PdfMemoryManagement.cpp when called from PoDoFo::PdfPredictorDecoder::PdfPredictorDecoder in base/PdfFiltersPrivate.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://sourceforge.net/p/podofo/tickets/34/; https://sourceforge.net/p/podofo/tickets/34/
CVE: CVE-2019-5491
Published: 2019-02-27
Description: Clustered Data ONTAP versions prior to 9.1P15 and 9.3 prior to 9.3P7 are susceptible to a vulnerability which discloses sensitive information to an unauthenticated user.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/107183; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.securityfocus.com/bid/107183
CVE: CVE-2019-8410
Published: 2019-02-27
Description: Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/holychang/maccms8/blob/master/xss2; https://github.com/holychang/maccms8/blob/master/xss2
CVE: CVE-2019-9211
Published: 2019-02-27
Description: There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead to denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00068.html; http://www.securityfocus.com/bid/107190; https://bugzilla.redhat.com/show_bug.cgi?id=1683499
CVE: CVE-2019-9212
Published: 2019-02-27
Description: SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184, CWE-502
References: https://github.com/alipay/sofa-hessian/issues/34; https://github.com/alipay/sofa-hessian/issues/34
CVE: CVE-2018-20244
Published: 2019-02-27
Description: In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/04/10/6; https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231%40%3Cdev.airflow.apache.org%3E; https://lists.apache.org/thread.html/f656fddf9c49293b3ec450437c46709eb01a12d1645136b2f1b8573b%40%3Cdev.airflow.apache.org%3E
CVE: CVE-2018-1775
Published: 2019-02-27
Description: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/107187; https://exchange.xforce.ibmcloud.com/vulnerabilities/148757; https://www.ibm.com/support/docview.wss?uid=ibm10872486
CVE: CVE-2019-4061
Published: 2019-02-27
Description: IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10870242; http://www.rapid7.com/db/modules/auxiliary/gather/ibm_bigfix_sites_packages_enum; http://www.securityfocus.com/bid/107189
CVE: CVE-2019-1559
Published: 2019-02-27
Description: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html
CVE: CVE-2019-5665
Published: 2019-02-27
Description: NVIDIA Windows GPU Display driver contains a vulnerability in the 3D vision component in which the stereo service software, when opening a file, does not check for hard links. This behavior may lead to code execution, denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-5666
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext in which the product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; https://nvidia.custhelp.com/app/answers/detail/a_id/4797
CVE: CVE-2019-5667
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to code execution, denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-5668
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSubmitCommandVirtual in which the application dereferences a pointer that it expects to be valid, but is NULL, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-5669
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation to read from or write to a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-5670
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation to read from or write to a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer which may lead to denial of service, escalation of privileges, code execution or information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-5671
Published: 2019-02-27
Description: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: http://support.lenovo.com/us/en/solutions/LEN-26250; https://nvidia.custhelp.com/app/answers/detail/a_id/4772; http://support.lenovo.com/us/en/solutions/LEN-26250
CVE: CVE-2019-9208
Published: 2019-02-28
Description: In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE: CVE-2019-9209
Published: 2019-02-28
Description: In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE: CVE-2019-9214
Published: 2019-02-28
Description: In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE: CVE-2019-9215
Published: 2019-02-28
Description: In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html
CVE: CVE-2019-9226
Published: 2019-02-28
Description: An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.php?m=opt&c=request URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/baigoStudio/baigoCMS/issues/7; https://github.com/baigoStudio/baigoCMS/issues/7
CVE: CVE-2019-9227
Published: 2019-02-28
Description: An issue was discovered in baigo CMS 2.1.1. There is a vulnerability that allows remote attackers to execute arbitrary code. A BG_SITE_NAME parameter with malicious code can be written into the opt_base.inc.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/baigoStudio/baigoCMS/issues/8; https://github.com/baigoStudio/baigoCMS/issues/8
CVE: CVE-2019-3582
Published: 2019-02-28
Description: Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances.
CVSS Score: 8.6 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10254; https://kc.mcafee.com/corporate/index?page=content&id=SB10254
CVE: CVE-2019-3598
Published: 2019-02-28
Description: Buffer Access with Incorrect Length Value in McAfee Agent (MA) 5.x allows remote unauthenticated users to potentially cause a denial of service via specifically crafted UDP packets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107205; https://kc.mcafee.com/corporate/index?page=content&id=SB10272; http://www.securityfocus.com/bid/107205
CVE: CVE-2019-3599
Published: 2019-02-28
Description: Information Disclosure vulnerability in Remote logging (which is disabled by default) in McAfee Agent (MA) 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled.
CVSS Score: 7.5 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10271; https://kc.mcafee.com/corporate/index?page=content&id=SB10271
CVE: CVE-2019-1986
Published: 2019-02-28
Description: In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-117838472.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106842; https://source.android.com/security/bulletin/2019-02-01; http://www.securityfocus.com/bid/106842
CVE: CVE-2019-1987
Published: 2019-02-28
Description: In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-118143775.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106842; https://source.android.com/security/bulletin/2019-02-01; http://www.securityfocus.com/bid/106842