deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9448
Published: 2019-09-06
Description: In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9449
Published: 2019-09-06
Description: In the Android kernel in FingerTipS touchscreen driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9450
Published: 2019-09-06
Description: In the Android kernel in the FingerTipS touchscreen driver there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-787
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9451
Published: 2019-09-06
Description: In the Android kernel in the touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9452
Published: 2019-09-06
Description: In the Android kernel in SEC_TS touch driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9453
Published: 2019-09-06
Description: In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://usn.ubuntu.com/4527-1/; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9454
Published: 2019-09-06
Description: In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2019-09-01; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9455
Published: 2019-09-06
Description: In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 2.3 (LOW)
CWE: CWE-209, CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; https://source.android.com/security/bulletin/pixel/2019-09-01; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
CVE: CVE-2019-9456
Published: 2019-09-06
Description: In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://source.android.com/security/bulletin/pixel/2019-09-01
CVE: CVE-2019-9457
Published: 2019-09-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14634. Reason: This candidate is a reservation duplicate of CVE-2018-14634. Notes: All CVE users should reference CVE-2018-14634 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-9458
Published: 2019-09-06
Description: In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html; https://source.android.com/security/bulletin/pixel/2019-09-01; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html
CVE: CVE-2019-9461
Published: 2019-09-06
Description: In the Android kernel in VPN routing there is a possible information disclosure. This could lead to remote information disclosure by an adjacent network attacker with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2019/12/05/1; http://www.openwall.com/lists/oss-security/2019/12/05/2; http://www.openwall.com/lists/oss-security/2019/12/08/1
CVE: CVE-2019-16089
Published: 2019-09-06
Description: An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-476
References: https://lore.kernel.org/patchwork/patch/1106884/; https://lore.kernel.org/patchwork/patch/1126650/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-16091
Published: 2019-09-08
Description: Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/hoene/libmysofa/compare/f571522...e07edb3; https://usn.ubuntu.com/4473-1/; https://github.com/hoene/libmysofa/compare/f571522...e07edb3
CVE: CVE-2019-16092
Published: 2019-09-08
Description: Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/hoene/libmysofa/compare/f571522...e07edb3; https://usn.ubuntu.com/4473-1/; https://github.com/hoene/libmysofa/compare/f571522...e07edb3
CVE: CVE-2019-16093
Published: 2019-09-08
Description: Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/hoene/libmysofa/compare/f571522...e07edb3; https://usn.ubuntu.com/4473-1/; https://github.com/hoene/libmysofa/compare/f571522...e07edb3
CVE: CVE-2019-16094
Published: 2019-09-08
Description: Symonics libmysofa 0.7 has an invalid read in readOHDRHeaderMessageDataLayout in hdf/dataobject.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/hoene/libmysofa/compare/f571522...e07edb3; https://usn.ubuntu.com/4473-1/; https://github.com/hoene/libmysofa/compare/f571522...e07edb3
CVE: CVE-2019-16095
Published: 2019-09-08
Description: Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/hoene/libmysofa/compare/f571522...e07edb3; https://usn.ubuntu.com/4473-1/; https://github.com/hoene/libmysofa/compare/f571522...e07edb3
CVE: CVE-2019-16096
Published: 2019-09-08
Description: Kilo 0.0.1 has a heap-based buffer overflow because there is an integer overflow in a calculation involving the number of tabs in one row.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-787
References: http://www.security-database.com/detail.php?alert=CVE-2019-16096; https://github.com/antirez/kilo/issues/60; https://vuldb.com/?id.141388
CVE: CVE-2016-10937
Published: 2019-09-08
Description: IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00042.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00002.html; https://bugs.debian.org/939702
CVE: CVE-2019-16097
Published: 2019-09-08
Description: core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.vmware.com/security/advisories/VMSA-2019-0015.html; https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517; https://github.com/goharbor/harbor/compare/v1.8.2...v1.9.0-rc1
CVE: CVE-2019-16099
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16100
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic from a single source.
CVSS Score: 7.5 (HIGH)
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16101
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST API, such as the rest/json/banners URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16102
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16103
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Bash OS shell via the spsshell feature.
CVSS Score: 7.2 (HIGH)
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16104
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16105
Published: 2019-09-08
Description: Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf; https://github.com/sdnewhop/sdwannewhope/blob/master/reports/Silverpeak%20EdgeConnect%20Multiple%20Vulnerabilities%20-%20032018.pdf
CVE: CVE-2019-16109
Published: 2019-09-08
Description: An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/plataformatec/devise/compare/v4.7.0...v4.7.1; https://github.com/plataformatec/devise/issues/5071; https://github.com/plataformatec/devise/pull/5132
CVE: CVE-2019-16113
Published: 2019-09-08
Description: Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html; http://packetstormsecurity.com/files/157988/Bludit-3.9.12-Directory-Traversal.html; http://packetstormsecurity.com/files/158569/Bludit-3.9.2-Directory-Traversal.html
CVE: CVE-2019-16115
Published: 2019-09-08
Description: In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41872; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41872
CVE: CVE-2019-16117
Published: 2019-09-08
Description: Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154433/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/models/Galleries.php?old=2135029&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fmodels%2FGalleries.php; https://wordpress.org/plugins/photo-gallery/#developers
CVE: CVE-2019-16118
Published: 2019-09-08
Description: Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154433/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/controllers/Options.php?old=2142624&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FOptions.php; https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/js/bwg.js?old=2135029&old_path=photo-gallery%2Ftrunk%2Fjs%2Fbwg.js
CVE: CVE-2019-16119
Published: 2019-09-08
Description: SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/154432/WordPress-Photo-Gallery-1.5.34-SQL-Injection.html; https://plugins.trac.wordpress.org/changeset/2150912/photo-gallery/trunk/admin/controllers/Albumsgalleries.php?old=1845136&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FAlbumsgalleries.php; https://wordpress.org/plugins/photo-gallery/#developers
CVE: CVE-2019-16120
Published: 2019-09-08
Description: CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://wordpress.org/plugins/event-tickets/#developers; https://wpvulndb.com/vulnerabilities/9858; https://www.exploit-db.com/exploits/47335
CVE: CVE-2019-16123
Published: 2019-09-09
Description: In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/47315; https://zerodays.lol/; https://www.exploit-db.com/exploits/47315
CVE: CVE-2019-16124
Published: 2019-09-09
Description: In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883; https://www.exploit-db.com/exploits/47326; https://zerodays.lol/
CVE: CVE-2019-16125
Published: 2019-09-09
Description: In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/47314; https://zerodays.lol/; https://www.exploit-db.com/exploits/47314
CVE: CVE-2019-16126
Published: 2019-09-09
Description: Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/getgrav/grav/issues/2657; https://github.com/getgrav/grav/issues/2657
CVE: CVE-2019-16130
Published: 2019-09-09
Description: YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.iwantacve.cn/index.php/archives/277/; https://github.com/weison-tech/yii2-cms/issues/2; http://www.iwantacve.cn/index.php/archives/277/
CVE: CVE-2019-16131
Published: 2019-09-09
Description: framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://www.iwantacve.cn/index.php/archives/289/; http://www.iwantacve.cn/index.php/archives/289/
CVE: CVE-2019-16132
Published: 2019-09-09
Description: An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary files via a title directory-traversal pathname followed by a crafted substring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.iwantacve.cn/index.php/archives/296/; http://www.iwantacve.cn/index.php/archives/296/
CVE: CVE-2019-16133
Published: 2019-09-09
Description: An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: http://www.iwantacve.cn/index.php/archives/271/; http://www.iwantacve.cn/index.php/archives/271/
CVE: CVE-2019-16137
Published: 2019-09-09
Description: An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-662
References: https://rustsec.org/advisories/RUSTSEC-2019-0013.html; https://rustsec.org/advisories/RUSTSEC-2019-0013.html
CVE: CVE-2019-16138
Published: 2019-09-09
Description: An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/image-rs/image/pull/985; https://rustsec.org/advisories/RUSTSEC-2019-0014.html; https://github.com/image-rs/image/pull/985
CVE: CVE-2019-16139
Published: 2019-09-09
Description: An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: https://github.com/llogiq/compact_arena/issues/22; https://rustsec.org/advisories/RUSTSEC-2019-0015.html; https://github.com/llogiq/compact_arena/issues/22
CVE: CVE-2019-16140
Published: 2019-09-09
Description: An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/sagebind/isahc/issues/2; https://rustsec.org/advisories/RUSTSEC-2019-0016.html; https://github.com/sagebind/isahc/issues/2
CVE: CVE-2019-16141
Published: 2019-09-09
Description: An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/matklad/once_cell/issues/46; https://rustsec.org/advisories/RUSTSEC-2019-0017.html; https://github.com/matklad/once_cell/issues/46
CVE: CVE-2019-16142
Published: 2019-09-09
Description: An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/ebkalderon/renderdoc-rs/pull/32; https://rustsec.org/advisories/RUSTSEC-2019-0018.html; https://github.com/ebkalderon/renderdoc-rs/pull/32
CVE: CVE-2019-16143
Published: 2019-09-09
Description: An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://rustsec.org/advisories/RUSTSEC-2019-0019.html; https://rustsec.org/advisories/RUSTSEC-2019-0019.html
CVE: CVE-2019-16144
Published: 2019-09-09
Description: An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://github.com/Xudong-Huang/generator-rs/issues/9; https://rustsec.org/advisories/RUSTSEC-2019-0020.html; https://github.com/Xudong-Huang/generator-rs/issues/9
CVE: CVE-2018-21011
Published: 2019-09-09
Description: The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://wordpress.org/plugins/charitable/#developers; https://www.wpcharitable.com/release-notes-security-release-1-5-14/; https://wordpress.org/plugins/charitable/#developers
CVE: CVE-2018-21012
Published: 2019-09-09
Description: The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cf7-invisible-recaptcha/#developers; https://www.pluginvulnerabilities.com/2018/05/17/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha/; https://wordpress.org/plugins/cf7-invisible-recaptcha/#developers