deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18718
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18719
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18720
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18721
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18722
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18723
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18724
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18725
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18726
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18727
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18728
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18729
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18730
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18731
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18732
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18733
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18734
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18735
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18736
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18737
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18738
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18739
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18740
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18741
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18742
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18743
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18744
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18745
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18746
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18747
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18748
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18749
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18750
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18751
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18752
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18753
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18754
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18755
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18756
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18757
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18758
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18759
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18760
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18761
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18762
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18763
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18764
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18765
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18766
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18767
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18768
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18769
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18770
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18771
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18772
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18773
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2019-18774
Published: 2019-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2010-3662
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3662; https://typo3.org/security/advisory/typo3-sa-2010-012/#SQL_Injection
CVE: CVE-2010-3663
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3663; https://typo3.org/security/advisory/typo3-sa-2010-012/#Arbitrary_Code_Execution
CVE: CVE-2010-3664
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3664; https://typo3.org/security/advisory/typo3-sa-2010-012/#Information_Disclosure
CVE: CVE-2010-3665
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3665; https://typo3.org/security/advisory/typo3-sa-2010-012/#XSS
CVE: CVE-2010-3666
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-330
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3666; https://typo3.org/security/advisory/typo3-sa-2010-012/#Insecure_Randomness
CVE: CVE-2010-3667
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3667; https://typo3.org/security/advisory/typo3-sa-2010-012/#Spam_Abuse
CVE: CVE-2013-4374
Published: 2019-11-04
Description: An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: https://access.redhat.com/security/cve/cve-2013-4374; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4374; https://access.redhat.com/security/cve/cve-2013-4374
CVE: CVE-2010-3668
Published: 2019-11-04
Description: TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3668; https://typo3.org/security/advisory/typo3-sa-2010-012/#Header_Injection
CVE: CVE-2010-3669
Published: 2019-11-04
Description: TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-601
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590719; https://security-tracker.debian.org/tracker/CVE-2010-3669; https://typo3.org/security/advisory/typo3-sa-2010-012/#XSS
CVE: CVE-2019-3685
Published: 2019-11-05
Description: Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://bugzilla.suse.com/show_bug.cgi?id=1142518; https://bugzilla.suse.com/show_bug.cgi?id=1142518
CVE: CVE-2019-10223
Published: 2019-11-05
Description: A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.openwall.com/lists/oss-security/2019/08/15/8; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223; https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2
CVE: CVE-2013-4107
Published: 2019-11-05
Description: Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://tobtu.com/decryptocat.php; https://vuldb.com/?id.9442; https://www.openwall.com/lists/oss-security/2013/07/10/15
CVE: CVE-2013-4110
Published: 2019-11-05
Description: Cryptocat has an Unspecified Chat Participant User List Disclosure
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://tobtu.com/decryptocat.php; https://vuldb.com/?id.9446; https://www.openwall.com/lists/oss-security/2013/07/10/15
CVE: CVE-2013-6364
Published: 2019-11-05
Description: Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0012.html; http://www.exploit-db.com/exploits/29519; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6364
CVE: CVE-2013-6365
Published: 2019-11-05
Description: Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-11/0013.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6365; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6365
CVE: CVE-2[PII_REDACTED]
Published: 2019-11-05
Description: gdm3 3.14.2 and possibly later has an information leak before screen lock
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2[PII_REDACTED]; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2[PII_REDACTED]; https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2[PII_REDACTED].json
CVE: CVE-2019-17221
Published: 2019-11-05
Description: PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/; https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/
CVE: CVE-2013-6460
Published: 2019-11-05
Description: Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: http://www.openwall.com/lists/oss-security/2013/12/27/2; http://www.securityfocus.com/bid/64513; https://access.redhat.com/security/cve/cve-2013-6460
CVE: CVE-2013-6461
Published: 2019-11-05
Description: Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: http://www.openwall.com/lists/oss-security/2013/12/27/2; http://www.securityfocus.com/bid/64513; https://access.redhat.com/security/cve/cve-2013-6461
CVE: CVE-2019-17212
Published: 2019-11-05
Description: Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-787
References: https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L257; https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L301; https://github.com/ARMmbed/mbed-os/blob/d91ed5fa42ea0f32e4422a3c562e7b045a17da40/features/frameworks/mbed-coap/source/sn_coap_parser.c#L310
CVE: CVE-2019-17598
Published: 2019-11-05
Description: An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://www.playframework.com/security/vulnerability; https://www.playframework.com/security/vulnerability/CVE-2019-17598-PlayWSHttpConnectAuthorizationHeaders; https://www.playframework.com/security/vulnerability
CVE: CVE-2019-17062
Published: 2019-11-05
Description: An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://oxidforge.org/en/security-bulletin-2019-002.html; https://oxidforge.org/en/security-bulletin-2019-002.html; https://oxidforge.org/en/security-bulletin-2019-002.html
CVE: CVE-2019-17211
Published: 2019-11-05
Description: An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculate the required memory for the CoAP message from the sn_coap_hdr_s data structure. Both returned_byte_count and src_coap_msg_ptr->payload_len are of type uint16_t. When added together, the result returned_byte_count can wrap around the maximum uint16_t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L1090; https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L355; https://github.com/ARMmbed/mbed-os/blob/d0686fd30b4d3d02efdc7e4d0fbf0dfe173543b6/features/frameworks/mbed-coap/source/sn_coap_builder.c#L524
CVE: CVE-2019-18631
Published: 2019-11-05
Description: The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 (18.8), 3.5.2 (18.11), and 3.6.0 (19.6) does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers to execute arbitrary code inside the Centrify process via (1) a crafted application that makes a pipe connection to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://centrify.force.com/support/Article/KB-22420-Centrify-Agent-for-Windows-Remote-Code-Execution-Vulnerability; https://centrify.force.com/support/Article/KB-22420-Centrify-Agent-for-Windows-Remote-Code-Execution-Vulnerability
CVE: CVE-2018-0178
Published: 2019-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2013-5661
Published: 2019-11-05
Description: Cache Poisoning issue exists in DNS Response Rate Limiting.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5661; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5661; https://security-tracker.debian.org/tracker/CVE-2013-5661