deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16200
Published: 2019-11-20
Description: GNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to the /cgi-bin/reader URI. The attacker must include a Content-length header with a large positive value that, when represented in 32 bit binary, evaluates to a negative number. The problem exists in the http_cgi_write function under http-cgi.c; however, exploitation might show svz_envblock_add in libserveez/passthrough.c as the location of the heap-based buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://github.com/agadient/SERVEEZ-CVE; https://github.com/agadient/SERVEEZ-CVE
CVE: CVE-2011-1028
Published: 2019-11-20
Description: The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2011-1028; https://seclists.org/oss-sec/2011/q1/313; https://security-tracker.debian.org/tracker/CVE-2011-1028
CVE: CVE-2012-6136
Published: 2019-11-20
Description: tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6136; https://security-tracker.debian.org/tracker/CVE-2012-6136; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6136
CVE: CVE-2013-0193
Published: 2019-11-20
Description: Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/01/17/15; https://matomo.org/changelog/piwik-1-10/; https://security-tracker.debian.org/tracker/CVE-2013-0193
CVE: CVE-2013-0194
Published: 2019-11-20
Description: Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/01/17/15; https://matomo.org/changelog/piwik-1-10/; https://security-tracker.debian.org/tracker/CVE-2013-0194
CVE: CVE-2013-0195
Published: 2019-11-20
Description: Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/01/17/15; https://matomo.org/changelog/piwik-1-10/; https://security-tracker.debian.org/tracker/CVE-2013-0195
CVE: CVE-2016-5194
Published: 2019-11-20
Description: Unspecified vulnerabilities in Google Chrome before 54.0.2840.59.
CVSS Score: 9.8 (CRITICAL)
References: https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html; https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html
CVE: CVE-2016-9652
Published: 2019-11-20
Description: Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00042.html; http://rhn.redhat.com/errata/RHSA-2016-2919.html
CVE: CVE-2010-4660
Published: 2019-11-20
Description: Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://security-tracker.debian.org/tracker/CVE-2010-4660; https://www.openwall.com/lists/oss-security/2011/01/25/13; https://security-tracker.debian.org/tracker/CVE-2010-4660
CVE: CVE-2011-0529
Published: 2019-11-20
Description: Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security-tracker.debian.org/tracker/CVE-2011-0529; https://www.openwall.com/lists/oss-security/2011/01/31/6; https://security-tracker.debian.org/tracker/CVE-2011-0529
CVE: CVE-2019-10765
Published: 2019-11-20
Description: iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd; https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634; https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd
CVE: CVE-2019-5540
Published: 2019-11-20
Description: VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability in vmnetdhcp. Successful exploitation of this issue may allow an attacker on a guest VM to disclose sensitive information by leaking memory from the host process.
CVSS Score: 7.7 (HIGH)
CWE: CWE-401
References: https://www.vmware.com/security/advisories/VMSA-2019-0021.html; https://www.vmware.com/security/advisories/VMSA-2019-0021.html
CVE: CVE-2019-5541
Published: 2019-11-20
Description: VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual network adapter. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition on their own VM.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2019-0021.html; https://www.vmware.com/security/advisories/VMSA-2019-0021.html
CVE: CVE-2019-5542
Published: 2019-11-20
Description: VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in the RPC handler. Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM.
CVSS Score: 7.7 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2019-0021.html; https://www.vmware.com/security/advisories/VMSA-2019-0021.html
CVE: CVE-2010-4659
Published: 2019-11-20
Description: Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2010-4659; https://security-tracker.debian.org/tracker/CVE-2010-4659; https://www.openwall.com/lists/oss-security/2011/01/25/13
CVE: CVE-2019-4530
Published: 2019-11-20
Description: IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165586; https://www.ibm.com/support/pages/node/1108503; https://exchange.xforce.ibmcloud.com/vulnerabilities/165586
CVE: CVE-2019-4561
Published: 2019-11-20
Description: IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 166456.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166456; https://www.ibm.com/support/pages/node/1108695; https://exchange.xforce.ibmcloud.com/vulnerabilities/166456
CVE: CVE-2019-18858
Published: 2019-11-20
Description: CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-10_CDS-68341.pdf; https://www.tenable.com/security/research/tra-2019-48; https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-10_CDS-68341.pdf
CVE: CVE-2019-3466
Published: 2019-11-20
Description: The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which could result in local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/; https://usn.ubuntu.com/4194-2/; https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation/
CVE: CVE-2011-4454
Published: 2019-11-20
Description: Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-remind_password.php, (2) tiki-index.php, (3) tiki-login_scr.php, or (4) tiki-index.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/107082/Tiki-Wiki-CMS-Groupware-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/107082/Tiki-Wiki-CMS-Groupware-Cross-Site-Scripting.html
CVE: CVE-2011-4455
Published: 2019-11-20
Description: Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/107082/Tiki-Wiki-CMS-Groupware-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/107082/Tiki-Wiki-CMS-Groupware-Cross-Site-Scripting.html
CVE: CVE-2015-1606
Published: 2019-11-20
Description: The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648; http://www.debian.org/security/2015/dsa-3184; http://www.openwall.com/lists/oss-security/2015/02/13/14
CVE: CVE-2015-1607
Published: 2019-11-20
Description: kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=2183683bd633818dd031b090b5530951de76f392; http://www.openwall.com/lists/oss-security/2015/02/13/14; http://www.openwall.com/lists/oss-security/2015/02/14/6
CVE: CVE-2012-1257
Published: 2019-11-20
Description: Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-319
References: http://developer.pidgin.im/ticket/14830; http://pidgin.im/pipermail/devel/2011-December/010521.html; http://developer.pidgin.im/ticket/14830
CVE: CVE-2013-1816
Published: 2019-11-20
Description: MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://security.gentoo.org/glsa/glsa-201310-21.xml; http://www.openwall.com/lists/oss-security/2013/03/05/4; http://www.securityfocus.com/bid/58306
CVE: CVE-2013-1817
Published: 2019-11-20
Description: MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://security.gentoo.org/glsa/glsa-201310-21.xml; http://www.openwall.com/lists/oss-security/2013/03/05/4; http://www.securityfocus.com/bid/58305
CVE: CVE-2013-2091
Published: 2019-11-20
Description: SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2013/05/14/3; https://exchange.xforce.ibmcloud.com/vulnerabilities/84248; https://github.com/Dolibarr/dolibarr/commit/9427e32e2ed54c1a2bc519a88c057207836df489
CVE: CVE-2013-2092
Published: 2019-11-20
Description: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/05/14/3; https://github.com/Dolibarr/dolibarr/commit/8a90598b23e1b[PII_REDACTED]941f7a96b04907005; https://security-tracker.debian.org/tracker/CVE-2013-2092
CVE: CVE-2013-2093
Published: 2019-11-20
Description: Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/05/14/3; https://exchange.xforce.ibmcloud.com/vulnerabilities/84249; https://github.com/Dolibarr/dolibarr/commit/526a80dd202bbca396687a502d52c27e06e97fff
CVE: CVE-2015-3166
Published: 2019-11-20
Description: The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://ubuntu.com/usn/usn-2621-1; http://www.debian.org/security/2015/dsa-3269; http://www.debian.org/security/2015/dsa-3270
CVE: CVE-2015-3167
Published: 2019-11-20
Description: contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://ubuntu.com/usn/usn-2621-1; http://www.debian.org/security/2015/dsa-3269; http://www.debian.org/security/2015/dsa-3270
CVE: CVE-2019-6852
Published: 2019-11-20
Description: A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/; https://www.se.com/ww/en/download/document/SEVD-2019-316-02%20/; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/
CVE: CVE-2019-6853
Published: 2019-11-20
Description: A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2019-316-01/; https://www.se.com/ww/en/download/document/SEVD-2019-316-01/
CVE: CVE-2019-19036
Published: 2019-11-21
Description: btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19036; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19039
Published: 2019-11-21
Description: __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19039; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html; https://usn.ubuntu.com/4414-1/
CVE: CVE-2019-19037
Published: 2019-11-21
Description: ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19037; https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2012-2238
Published: 2019-11-21
Description: trytond 2.4: ModelView.button fails to validate authorization
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://hg.tryton.org/2.4/trytond/rev/279f0031b461; http://www.openwall.com/lists/oss-security/2012/09/11/10; http://www.securityfocus.com/bid/55503
CVE: CVE-2012-2350
Published: 2019-11-21
Description: pam_shield before 0.9.4: Default configuration does not perform protective action
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/05/12/3; https://access.redhat.com/security/cve/cve-2012-2350; https://security-tracker.debian.org/tracker/CVE-2012-2350
CVE: CVE-2012-3543
Published: 2019-11-21
Description: mono 2.10.x ASP.NET Web Form Hash collision DoS
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/08/28/14; http://www.securityfocus.com/bid/55251; http://www.ubuntu.com/usn/USN-2547-1
CVE: CVE-2013-7171
Published: 2019-11-21
Description: Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which could allow remote attackers to execute arbitrary code with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/12/20/1; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7171; https://exchange.xforce.ibmcloud.com/vulnerabilities/89915
CVE: CVE-2013-7172
Published: 2019-11-21
Description: Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package, which could allow local users to use RPATH information to execute arbitrary code with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/12/20/1; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7172; https://exchange.xforce.ibmcloud.com/vulnerabilities/89916
CVE: CVE-2014-0083
Published: 2019-11-21
Description: The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-916
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0083; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0083; https://github.com/ruby-ldap/ruby-net-ldap/commit/b412ca05f6b430eaa1ce97ac95885b4cf187b04a
CVE: CVE-2012-3460
Published: 2019-11-21
Description: cumin: At installation postgresql database user created without password
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2012-3460; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3460; https://access.redhat.com/security/cve/cve-2012-3460
CVE: CVE-2012-4524
Published: 2019-11-21
Description: xlockmore before 5.43 'dclock' security bypass vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091108.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091150.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091709.html
CVE: CVE-2014-0084
Published: 2019-11-21
Description: Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0084; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0084
CVE: CVE-2014-1935
Published: 2019-11-21
Description: 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/11/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737206; https://security-tracker.debian.org/tracker/CVE-2014-1935
CVE: CVE-2014-1936
Published: 2019-11-21
Description: rc before 1.7.1-5 insecurely creates temporary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/11/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737125; https://security-tracker.debian.org/tracker/CVE-2014-1936
CVE: CVE-2014-1937
Published: 2019-11-21
Description: Gamera before 3.4.1 insecurely creates temporary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/02/11/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737324; https://security-tracker.debian.org/tracker/CVE-2014-1937
CVE: CVE-2014-1938
Published: 2019-11-21
Description: python-rply before 0.7.4 insecurely creates temporary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2014/02/11/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737627; https://security-tracker.debian.org/tracker/CVE-2014-1938
CVE: CVE-2014-3700
Published: 2019-11-21
Description: eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3700; https://security-tracker.debian.org/tracker/CVE-2014-3700; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3700
CVE: CVE-2018-13916
Published: 2019-11-21
Description: Out-of-bounds memory access in Qurt kernel function when using the identifier to access Qurt kernel buffer to retrieve thread data. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCM2150, QCN7605, QCS404, QCS405, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX55, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin