deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16276
Published: 2019-09-30
Description: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html; https://access.redhat.com/errata/RHSA-2020:0101
CVE: CVE-2019-17049
Published: 2019-09-30
Description: NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://community.netgear.com/t5/Hardware-VPN-Firewalls-and/Successful-hack-of-our-SRX5308/m-p/1805846; https://community.netgear.com/t5/Hardware-VPN-Firewalls-and/Successful-hack-of-our-SRX5308/m-p/1805846
CVE: CVE-2019-17050
Published: 2019-09-30
Description: An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment.
CVSS Score: 7.2 (HIGH)
CWE: CWE-639
References: https://github.com/the-control-group/voyager/issues/4322; https://github.com/the-control-group/voyager/issues/4322
CVE: CVE-2019-13123
Published: 2019-09-30
Description: Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 1 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13124
Published: 2019-09-30
Description: Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 2 of 2).
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17051
Published: 2019-09-30
Description: Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://evernote.com/security/updates#MACOSNOTE-28956; https://www.youtube.com/watch?v=OG2tKlZX5bg; https://evernote.com/security/updates#MACOSNOTE-28956
CVE: CVE-2019-16760
Published: 2019-09-30
Description: Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-16, CWE-494
References: http://www.openwall.com/lists/oss-security/2019/10/08/3; https://gist.github.com/pietroalbini/0d293b24a44babbeb6187e06eebd4992; https://github.com/rust-lang/rust/security/advisories/GHSA-phjm-8x66-qw4r
CVE: CVE-2019-3728
Published: 2019-09-30
Description: RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions from 4.0.0 before 4.0.13 and from 4.1.0 before 4.4 and RSA Crypto-C versions from 6.0.0 through 6.4.* are vulnerable to an out-of-bounds read vulnerability when processing DSA signature. A malicious remote user could potentially exploit this vulnerability to cause a crash in the library of the affected system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2140
CVE: CVE-2019-3729
Published: 2019-09-30
Description: RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with adjacent network access could potentially exploit this vulnerability to cause a crash in the library of the affected system.
CVSS Score: 2.4 (LOW)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054
CVE: CVE-2019-3730
Published: 2019-09-30
Description: RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulnerability, also known as a “padding oracle attack vulnerability”. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-649, CWE-209
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054
CVE: CVE-2019-3731
Published: 2019-09-30
Description: RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310, CWE-203
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054
CVE: CVE-2019-3732
Published: 2019-09-30
Description: RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) versions prior to 4.1.6.1 (in 4.1.x) and versions prior to 4.3.3 (4.2.x and 4.3.x) are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-385, CWE-203
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054
CVE: CVE-2019-3733
Published: 2019-09-30
Description: RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before Release vulnerability, also known as 'Heap Inspection vulnerability'. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-316, CWE-459
References: https://www.dell.com/support/kbdoc/000194054; https://www.dell.com/support/kbdoc/000194054
CVE: CVE-2019-16508
Published: 2019-10-01
Description: The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an Integer Overflow and gain privileges via a malicious application. This occurs because of intentional access for the GPU process to /dev/dri/card1 and the PowerVR ioctl handler, as demonstrated by PVRSRVBridgeSyncPrimOpCreate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://bugs.chromium.org/p/chromium/issues/detail?id=960106; https://bugs.chromium.org/p/chromium/issues/detail?id=960106
CVE: CVE-2019-15940
Published: 2019-10-01
Description: Victure PC530 devices allow unauthenticated TELNET access as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://blog.avira.com/victure-pc530-home-insecurity-you-can-install-yourself/; https://www.govicture.com/pc530; https://blog.avira.com/victure-pc530-home-insecurity-you-can-install-yourself/
CVE: CVE-2019-10431
Published: 2019-10-01
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2019/10/01/2; https://access.redhat.com/errata/RHSA-2019:4055; https://access.redhat.com/errata/RHSA-2019:4089
CVE: CVE-2019-10432
Published: 2019-10-01
Description: Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2019/10/01/2; https://access.redhat.com/errata/RHSA-2019:4055; https://access.redhat.com/errata/RHSA-2019:4089
CVE: CVE-2019-10433
Published: 2019-10-01
Description: Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 3.3 (LOW)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2019/10/01/2; https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423; https://www.zerodayinitiative.com/advisories/ZDI-19-862/
CVE: CVE-2019-10434
Published: 2019-10-01
Description: Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/10/01/2; https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515; http://www.openwall.com/lists/oss-security/2019/10/01/2
CVE: CVE-2019-10435
Published: 2019-10-01
Description: Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/10/01/2; https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524; http://www.openwall.com/lists/oss-security/2019/10/01/2
CVE: CVE-2019-14952
Published: 2019-10-01
Description: JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-14954
Published: 2019-10-01
Description: JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-15039
Published: 2019-10-01
Description: An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155874/JetBrains-TeamCity-2018.2.4-Remote-Code-Execution.html; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; http://packetstormsecurity.com/files/155874/JetBrains-TeamCity-2018.2.4-Remote-Code-Execution.html
CVE: CVE-2019-17052
Published: 2019-10-01
Description: ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-0614e2b73768.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=2c675dab816278a1724c1e93b384c2f05a11cb31; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0614e2b73768b502fc32a[PII_REDACTED]6d98aae2c
CVE: CVE-2019-17053
Published: 2019-10-01
Description: ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0edc3f703f7bcaf550774b5d43ab727bcd0fe06b; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e69dbd4619e7674c1679cba49afd9dd9ac347eef
CVE: CVE-2019-17054
Published: 2019-10-01
Description: atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0edc3f703f7bcaf550774b5d43ab727bcd0fe06b; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cc03e8aa36c51f3b26a0d21a3c4ce2809c842ac
CVE: CVE-2019-17055
Published: 2019-10-01
Description: base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00039.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-17056
Published: 2019-10-01
Description: llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-10202
Published: 2019-10-01
Description: A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2[PII_REDACTED], CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10202; https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E; https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E
CVE: CVE-2019-11275
Published: 2019-10-01
Description: Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74, CWE-1236
References: https://pivotal.io/security/cve-2019-11275; https://pivotal.io/security/cve-2019-11275
CVE: CVE-2019-4246
Published: 2019-10-01
Description: IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks against the system. IBM X-Force ID: 159521.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159521; https://www.ibm.com/support/pages/node/884380; https://exchange.xforce.ibmcloud.com/vulnerabilities/159521
CVE: CVE-2019-4494
Published: 2019-10-01
Description: IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164115.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164115; https://www.ibm.com/support/pages/node/1074690; https://exchange.xforce.ibmcloud.com/vulnerabilities/164115
CVE: CVE-2019-4495
Published: 2019-10-01
Description: IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164116.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164116; https://www.ibm.com/support/pages/node/1074690; https://exchange.xforce.ibmcloud.com/vulnerabilities/164116
CVE: CVE-2019-4497
Published: 2019-10-01
Description: IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164118.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/164118; https://www.ibm.com/support/pages/node/1074690; https://exchange.xforce.ibmcloud.com/vulnerabilities/164118
CVE: CVE-2019-14953
Published: 2019-10-01
Description: JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-14955
Published: 2019-10-01
Description: In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-14957
Published: 2019-10-01
Description: The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-14960
Published: 2019-10-01
Description: JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-15038
Published: 2019-10-01
Description: An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-17063
Published: 2019-10-01
Description: In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling.
CVSS Score: 5.5 (MEDIUM)
References: http://downloads.snowtide.com/CHANGELOG.html; http://downloads.snowtide.com/CHANGELOG.html
CVE: CVE-2019-17064
Published: 2019-10-01
Description: Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://packetstormsecurity.com/files/154713/Xpdf-4.02-NULL-Pointer-Dereference.html; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41890; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5PYIAP2RXTYD4Y4FYFIK5K644LMDJWX/
CVE: CVE-2019-14961
Published: 2019-10-01
Description: JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-15042
Published: 2019-10-01
Description: An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/; https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE: CVE-2019-16942
Published: 2019-10-01
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:3901; https://access.redhat.com/errata/RHSA-2020:0159; https://access.redhat.com/errata/RHSA-2020:0160
CVE: CVE-2019-16943
Published: 2019-10-01
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2020:0159; https://access.redhat.com/errata/RHSA-2020:0160; https://access.redhat.com/errata/RHSA-2020:0161