deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10775
Published: 2020-01-02
Description: ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://snyk.io/vuln/SNYK-JS-ECSTATIC-540354; https://snyk.io/vuln/SNYK-JS-ECSTATIC-540354
CVE: CVE-2019-14859
Published: 2020-01-02
Description: A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347, CWE-347
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859; https://github.com/warner/python-ecdsa/issues/114; https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3
CVE: CVE-2019-14862
Published: 2020-01-02
Description: There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862; https://snyk.io/vuln/npm:knockout:20180213; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2019-14863
Published: 2020-01-02
Description: There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863; https://snyk.io/vuln/npm:angular:20150807; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14863
CVE: CVE-2019-14864
Published: 2020-01-02
Description: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117, CWE-532, CWE-532
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864
CVE: CVE-2019-20219
Published: 2020-01-02
Description: ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/miniupnp/ngiflib/issues/15; https://github.com/miniupnp/ngiflib/issues/15
CVE: CVE-2019-20225
Published: 2020-01-02
Description: MyBB before 1.8.22 allows an open redirect on login.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/; https://mybb.com/versions/1.8.22/; https://blog.mybb.com/2019/12/30/mybb-1-8-22-released-security-maintenance-release/
CVE: CVE-2013-4532
Published: 2020-01-02
Description: Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.ubuntu.com/usn/USN-2342-1; https://access.redhat.com/security/cve/cve-2013-4532; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739589
CVE: CVE-2013-4752
Published: 2020-01-02
Description: Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114450.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114461.html; http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
CVE: CVE-2014-0048
Published: 2020-01-02
Description: An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2015/03/24/18; http://www.openwall.com/lists/oss-security/2015/03/24/22; http://www.openwall.com/lists/oss-security/2015/03/24/23
CVE: CVE-2014-0104
Published: 2020-01-02
Description: In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2014-0104; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0104; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0104
CVE: CVE-2019-10205
Published: 2020-01-02
Description: A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10205; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10205
CVE: CVE-2013-3619
Published: 2020-01-02
Description: Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: http://support.citrix.com/article/CTX216642; https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/89044
CVE: CVE-2013-3620
Published: 2020-01-02
Description: Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://support.citrix.com/article/CTX216642; https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities; https://exchange.xforce.ibmcloud.com/vulnerabilities/89045
CVE: CVE-2013-3621
Published: 2020-01-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-3607. Reason: This candidate is a reservation duplicate of CVE-2013-3607. Notes: All CVE users should reference CVE-2013-3607 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-0161
Published: 2020-01-02
Description: ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2014-0161; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161; https://access.redhat.com/security/cve/cve-2014-0161
CVE: CVE-2010-3782
Published: 2020-01-02
Description: obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00001.html
CVE: CVE-2013-3944
Published: 2020-01-02
Description: Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via an IMAGE tag.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/64385; https://exchange.xforce.ibmcloud.com/vulnerabilities/89804; https://www.irfanview.com/history_old.htm
CVE: CVE-2013-3945
Published: 2020-01-02
Description: The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89805; https://www.irfanview.com/history_old.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/89805
CVE: CVE-2013-3946
Published: 2020-01-02
Description: Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a levels header.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89806; https://www.irfanview.com/history_old.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/89806
CVE: CVE-2013-6242
Published: 2020-01-02
Description: Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-rev12 allows remote attackers to inject arbitrary web script or HTML via the subject of an email. NOTE: the vulnerabilities related to the body of the email and the publication name were SPLIT from this CVE ID because they affect different sets of versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2013/Nov/127; http://www.securitytracker.com/id/1029394
CVE: CVE-2013-7062
Published: 2020-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2013/q4/467; http://seclists.org/oss-sec/2013/q4/485; https://exchange.xforce.ibmcloud.com/vulnerabilities/89623
CVE: CVE-2013-7485
Published: 2020-01-02
Description: Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 allows remote attackers to inject arbitrary web script or HTML via the publication name, which is not properly handled in an error message. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/100385; http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2013/Nov/127
CVE: CVE-2013-7486
Published: 2020-01-02
Description: Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects different sets of versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/124185/Open-Xchange-frontend6-6.22.4-backend-7.4.0-Cross-Site-Scripting.html; http://seclists.org/bugtraq/2013/Nov/127; http://www.securitytracker.com/id/1029394
CVE: CVE-2014-4553
Published: 2020-01-02
Description: Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss/; http://codevigilant.com/disclosure/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss/
CVE: CVE-2013-3246
Published: 2020-01-02
Description: Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer in an XCF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xml; https://exchange.xforce.ibmcloud.com/vulnerabilities/84643; http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xml
CVE: CVE-2013-3247
Published: 2020-01-02
Description: Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compressed layer in an XCF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xml; https://exchange.xforce.ibmcloud.com/vulnerabilities/84642; http://www.fuzzmyapp.com/advisories/FMA-2013-003/FMA-2013-003-EN.xml
CVE: CVE-2013-3931
Published: 2020-01-02
Description: Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to inject arbitrary web script or HTML via the property_name parameter, related to editing property details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/61634; https://exchange.xforce.ibmcloud.com/vulnerabilities/86251; https://www.joomlacorner.com/joomla-news/joomla-vulnerability-news/834-joomla-jomres-component-script-insertion-and-sql-injection-vulnerabilities.html
CVE: CVE-2013-3932
Published: 2020-01-02
Description: SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Business Manager" permission to execute arbitrary SQL commands via the id parameter in an editProfile action to administrator/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/61635; https://exchange.xforce.ibmcloud.com/vulnerabilities/86252; https://www.joomlacorner.com/joomla-news/joomla-vulnerability-news/834-joomla-jomres-component-script-insertion-and-sql-injection-vulnerabilities.html
CVE: CVE-2013-3937
Published: 2020-01-02
Description: Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via the biBitCount field in a BMP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087; http://secunia.com/advisories/52101; http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
CVE: CVE-2013-3939
Published: 2020-01-02
Description: xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087; http://secunia.com/advisories/52101; http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
CVE: CVE-2013-3941
Published: 2020-01-02
Description: Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker, which triggers an incorrect memory allocation, or (2) the lqcd field in a QCD marker in a crafted JPEG2000 file, which leads to a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087; http://secunia.com/advisories/52101; http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
CVE: CVE-2013-7351
Published: 2020-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS, (2) showATOM, or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/oss-sec/2014/q2/1; http://seclists.org/oss-sec/2014/q2/4; https://exchange.xforce.ibmcloud.com/vulnerabilities/92215
CVE: CVE-2014-0011
Published: 2020-01-02
Description: Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1050928; https://github.com/TigerVNC/tigervnc/releases/tag/v1.3.1; https://bugzilla.redhat.com/show_bug.cgi?id=1050928
CVE: CVE-2014-0169
Published: 2020-01-02
Description: In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an intended functionality, it was not clearly documented which can mislead users into thinking that a security domain cache is isolated to a single application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://access.redhat.com/security/cve/cve-2014-0169; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0169; https://access.redhat.com/security/cve/cve-2014-0169
CVE: CVE-2014-0183
Published: 2020-01-02
Description: Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2014-0183; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0183; https://access.redhat.com/security/cve/cve-2014-0183
CVE: CVE-2014-0245
Published: 2020-01-02
Description: It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://access.redhat.com/errata/RHSA-2015:1009; https://access.redhat.com/security/cve/cve-2014-0245; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0245
CVE: CVE-2014-3590
Published: 2020-01-02
Description: Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2014-3590; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3590; https://security-tracker.debian.org/tracker/CVE-2014-3590
CVE: CVE-2013-0737
Published: 2020-01-02
Description: Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the fieldnames parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/84698; https://exchange.xforce.ibmcloud.com/vulnerabilities/84698
CVE: CVE-2013-1420
Published: 2020-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0005.html; http://get-simple.info/changelog; https://www.htbridge.com/advisory/HTB23141
CVE: CVE-2013-1642
Published: 2020-01-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) dir, (2) item, (3) order, (4) searchitem, (5) selitems[], or (6) srt parameter to index.php or (7) the QUERY_STRING to index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89056; https://github.com/realtimeprojects/quixplorer; https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt
CVE: CVE-2014-6275
Published: 2020-01-02
Description: FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted on the same server than FusionForge, it can allow users to incorrectly access on-disk private data in FusionForge.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://lists.fusionforge.org/pipermail/fusionforge-general/2014-September/002824.html; https://security-tracker.debian.org/tracker/CVE-2014-6275; http://lists.fusionforge.org/pipermail/fusionforge-general/2014-September/002824.html
CVE: CVE-2014-8182
Published: 2020-01-02
Description: An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193
References: https://access.redhat.com/security/cve/cve-2014-8182; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8182; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-8182
CVE: CVE-2[PII_REDACTED]
Published: 2020-01-02
Description: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2[PII_REDACTED]; https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626; https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
CVE: CVE-2019-20329
Published: 2020-01-03
Description: OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: https://github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/common/config.go#L135; https://github.com/open-lambda/open-lambda/blob/9f7f935195ca74700c60ebc1ecfdaefad40d144b/src/server/lambdaServer.go#L92-L97; https://github.com/open-lambda/open-lambda/issues/92
CVE: CVE-2020-5310
Published: 2020-01-03
Description: libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/