deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5163
Published: 2019-12-03
Description: An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher and a local_address, arbitrary UDP packets can cause a FATAL error code path and exit. An attacker can send arbitrary UDP packets to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0956
CVE: CVE-2019-5164
Published: 2019-12-03
Description: An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. Specially crafted network packets sent to ss-manager can cause an arbitrary binary to run, resulting in code execution and privilege escalation. An attacker can send network packets to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306, CWE-306
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00061.html; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0958
CVE: CVE-2013-7325
Published: 2019-12-03
Description: An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2014/02/12/14; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7325; https://security-tracker.debian.org/tracker/CVE-2013-7325
CVE: CVE-2015-7542
Published: 2019-12-03
Description: A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174484.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174540.html; http://lists.opensuse.org/opensuse-updates/2018-01/msg00038.html
CVE: CVE-2019-18850
Published: 2019-12-04
Description: TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP methods, also via predictible responses when accessing and interacting with the "SITE_PATH_QUERY".
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-330
References: https://github.com/trustedsec/trevorc2/blob/master/CHANGELOG.txt; https://github.com/trustedsec/trevorc2/issues/18; https://github.com/trustedsec/trevorc2/blob/master/CHANGELOG.txt
CVE: CVE-2019-14909
Published: 2019-12-04
Description: A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287, CWE-305, CWE-592, CWE-287
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909
CVE: CVE-2019-15638
Published: 2019-12-04
Description: COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://forum.copadata.com/; https://www.copadata.com/en/support-services/knowledge-base-faq/pcd-sva-2019-5-nbspcopa-data-editor-security-3225/; https://www.copadata.com/fileadmin/user_upload/faq/files/CD_SVA_2019_5.pdf
CVE: CVE-2019-11923
Published: 2019-12-04
Description: In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/facebook/mcrouter/commit/98ce6624cd2563cfdb5da3b2949d5e1e03867034; https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release; https://www.facebook.com/security/advisories/cve-2019-11923
CVE: CVE-2019-11937
Published: 2019-12-04
Description: In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/facebook/mcrouter/commit/97e033b3bb0cb16b61bf49f0dc7f311a3e0edd1b; https://github.com/facebook/mcrouter/releases/tag/v0.41.0-release; https://www.facebook.com/security/advisories/cve-2019-11937
CVE: CVE-2018-0728
Published: 2019-12-04
Description: This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-20; https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE: CVE-2018-0729
Published: 2019-12-04
Description: This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-20; https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE: CVE-2018-0730
Published: 2019-12-04
Description: This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-20; https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
CVE: CVE-2019-11930
Published: 2019-12-04
Description: An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-763, CWE-763
References: https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36; https://hhvm.com/blog/2019/10/28/security-update.html; https://www.facebook.com/security/advisories/cve-2019-11930
CVE: CVE-2019-11934
Published: 2019-12-04
Description: Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee; https://www.facebook.com/security/advisories/cve-2019-11934; https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee
CVE: CVE-2019-11935
Published: 2019-12-04
Description: Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-120
References: https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7; https://hhvm.com/blog/2019/10/28/security-update.html; https://www.facebook.com/security/advisories/cve-2019-11935
CVE: CVE-2019-11936
Published: 2019-12-04
Description: Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-626
References: https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373; https://hhvm.com/blog/2019/10/28/security-update.html; https://www.facebook.com/security/advisories/cve-2019-11936
CVE: CVE-2019-11940
Published: 2019-12-04
Description: In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4f; https://www.facebook.com/security/advisories/cve-2019-11940; https://github.com/facebook/proxygen/commit/f43b134cc5c19d8532e7fb670a1c02e85f7a8d4f
CVE: CVE-2019-17554
Published: 2019-12-04
Description: The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://packetstormsecurity.com/files/155619/Apache-Olingo-OData-4.6.x-XML-Injection.html; https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E; https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d7Ty%3DL-n_iAzT6vcQp65BY29XZDS5tMoM8MdDrb1moM7A%40mail.gmail.com%3E
CVE: CVE-2019-17556
Published: 2019-12-04
Description: Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E; https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E
CVE: CVE-2019-19555
Published: 2019-12-04
Description: read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2020/01/msg00018.html; https://sourceforge.net/p/mcj/tickets/55/; https://lists.debian.org/debian-lts-announce/2020/01/msg00018.html
CVE: CVE-2019-7197
Published: 2019-12-04
Description: A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/nas-201911-26; https://www.qnap.com/zh-tw/security-advisory/nas-201911-26
CVE: CVE-2019-7201
Published: 2019-12-04
Description: An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak Replicator 4.5.12.1108.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.qnap.com/zh-tw/security-advisory/nas-201912-02; https://www.qnap.com/zh-tw/security-advisory/nas-201912-02
CVE: CVE-2019-17555
Published: 2019-12-04
Description: The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d65UmudJ_MQkFXEv9YY_wwZbRA3sgtNDzMoLM51Qh%3DRCA%40mail.gmail.com%3E; https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d65UmudJ_MQkFXEv9YY_wwZbRA3sgtNDzMoLM51Qh%3DRCA%40mail.gmail.com%3E
CVE: CVE-2019-18346
Published: 2019-12-04
Description: A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, the attacker can send arbitrary requests in the name of the user to the application. If the attacked user is an administrator, the attacker could for example add a new admin user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155629/DAViCal-CalDAV-Server-1.1.8-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2019/Dec/17; http://seclists.org/fulldisclosure/2019/Dec/18
CVE: CVE-2019-18347
Published: 2019-12-04
Description: A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155628/DAViCal-CalDAV-Server-1.1.8-Persistent-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Dec/17; http://seclists.org/fulldisclosure/2019/Dec/18
CVE: CVE-2019-19576
Published: 2019-12-04
Description: class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html; https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a[PII_REDACTED]24; https://github.com/jra89/CVE-2019-19576
CVE: CVE-2019-19133
Published: 2019-12-04
Description: The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Dec/6; http://seclists.org/fulldisclosure/2019/Dec/6
CVE: CVE-2019-19228
Published: 2019-12-04
Description: Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/; https://seclists.org/bugtraq/2019/Dec/5
CVE: CVE-2019-19229
Published: 2019-12-04
Description: admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/; https://seclists.org/bugtraq/2019/Dec/5
CVE: CVE-2019-19364
Published: 2019-12-04
Description: A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://gist.github.com/Eli-Paz/482b514320009f3e76ea712cde3bc350; https://gist.github.com/Eli-Paz/482b514320009f3e76ea712cde3bc350
CVE: CVE-2019-11216
Published: 2019-12-04
Description: BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-611
References: http://packetstormsecurity.com/files/155552/BMC-Smart-Reporting-7.3-20180418-XML-Injection.html; http://seclists.org/fulldisclosure/2019/Dec/7; https://docs.bmc.com/docs/itsm90/export-and-import-repository-509983929.html
CVE: CVE-2019-16752
Published: 2019-12-04
Description: An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf; https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf
CVE: CVE-2019-16753
Published: 2019-12-04
Description: An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a representation of strings, rather than being composed of their binary representations. This is a weak signature scheme design that would allow the reuse of signatures in some cases (or even the reuse of signatures, intended for one type of message, for another type). This also affects Private Instant Verified Transactions (PIVX) through 3.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf; https://officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf
CVE: CVE-2013-2745
Published: 2019-12-04
Description: An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.html; http://media.blackhat.com/bh-us-12/Briefings/Cutlip/BH_US_12_Cutlip_SQL_Exploitation_WP.pdf; https://debian.pkgs.org/8/debian-main-amd64/minidlna_1.1.2+dfsg-1.1+b3_amd64.deb.html
CVE: CVE-2019-19579
Published: 2019-12-04
Description: An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; http://www.openwall.com/lists/oss-security/2019/12/05/7; http://xenbits.xen.org/xsa/advisory-306.html
CVE: CVE-2019-19519
Published: 2019-12-05
Description: In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Dec/14; http://www.openwall.com/lists/oss-security/2019/12/04/5
CVE: CVE-2019-19520
Published: 2019-12-05
Description: xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Dec/14; http://www.openwall.com/lists/oss-security/2019/12/04/5
CVE: CVE-2019-19521
Published: 2019-12-05
Description: libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Dec/14; http://www.openwall.com/lists/oss-security/2019/12/04/5
CVE: CVE-2019-19522
Published: 2019-12-05
Description: OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://packetstormsecurity.com/files/155572/Qualys-Security-Advisory-OpenBSD-Authentication-Bypass-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Dec/14; http://www.openwall.com/lists/oss-security/2019/12/04/5
CVE: CVE-2019-19587
Published: 2019-12-05
Description: In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0658; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0658
CVE: CVE-2019-19553
Published: 2019-12-05
Description: In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15961; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=34d2e0d5318d0a7e9889498c721639e5cbf4ce45
CVE: CVE-2019-19588
Published: 2019-12-05
Description: The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/kvesteri/validators/issues/86; https://github.com/kvesteri/validators/issues/86