deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-11-27
Description: The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2[PII_REDACTED]; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2[PII_REDACTED]
CVE: CVE-2019-19242
Published: 2019-11-27
Description: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/sqlite/sqlite/commit/57f7ece78410a8aae86aa4625fb7556897db384c; https://usn.ubuntu.com/4205-1/
CVE: CVE-2011-2187
Published: 2019-11-27
Description: xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://access.redhat.com/security/cve/cve-2011-2187; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627382; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2187
CVE: CVE-2012-2248
Published: 2019-11-27
Description: An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2012/10/15/1; http://www.openwall.com/lists/oss-security/2012/10/17/13; http://www.openwall.com/lists/oss-security/2012/10/17/14
CVE: CVE-2012-6655
Published: 2019-11-27
Description: An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: http://www.openwall.com/lists/oss-security/2014/08/16/7; http://www.securityfocus.com/bid/69245; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6655
CVE: CVE-2011-2207
Published: 2019-11-27
Description: dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2011-2207; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627377; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2207
CVE: CVE-2011-2480
Published: 2019-11-27
Description: Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/security/cve/cve-2011-2480; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631160; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631161
CVE: CVE-2013-2625
Published: 2019-11-27
Description: An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0009.html; http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html; http://www.securityfocus.com/bid/58936
CVE: CVE-2014-3875
Published: 2019-11-27
Description: The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/126906/F-EX-20140313-1-HTTP-Response-Splitting-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Jun/1; http://www.openwall.com/lists/oss-security/2014/06/03/6
CVE: CVE-2019-19366
Published: 2019-11-27
Description: A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8e; https://github.com/fusionpbx/fusionpbx/commit/f3047c83f3022a4780dca95ed7bccbf3a6fa868e; https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8e
CVE: CVE-2019-19367
Published: 2019-11-27
Description: A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8e; https://github.com/fusionpbx/fusionpbx/commit/72a5ce4d2d6bc0ec0e72bbfb76487e4761f292c5; https://gist.github.com/xax007/94183b11bdfe579fd860a37e74cd3a8e
CVE: CVE-2011-2515
Published: 2019-11-27
Description: PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://access.redhat.com/security/cve/cve-2011-2515; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2515; https://security-tracker.debian.org/tracker/CVE-2011-2515
CVE: CVE-2011-2523
Published: 2019-11-27
Description: vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html; https://access.redhat.com/security/cve/cve-2011-2523; https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Execution.html
CVE: CVE-2011-2717
Published: 2019-11-27
Description: The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://access.redhat.com/security/cve/cve-2011-2717; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2717; https://vigilance.fr/vulnerability/dhcp6c-shell-command-injection-10869
CVE: CVE-2019-15705
Published: 2019-11-27
Description: An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://fortiguard.com/advisory/FG-IR-19-236; https://fortiguard.com/advisory/FG-IR-19-236
CVE: CVE-2019-6674
Published: 2019-11-27
Description: On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining configuration.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K21135478; https://support.f5.com/csp/article/K21135478
CVE: CVE-2019-6665
Published: 2019-11-27
Description: On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device communication between the BIG-IP ASM Central Policy Builder and the BIG-IQ/Enterprise Manager/F5 iWorkflow will be able to set up the proxy the same way and intercept the traffic.
CVSS Score: 9.4 (CRITICAL)
References: https://support.f5.com/csp/article/K26462555; https://support.f5.com/csp/article/K26462555
CVE: CVE-2019-6666
Published: 2019-11-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K92411323; https://support.f5.com/csp/article/K92411323
CVE: CVE-2019-6667
Published: 2019-11-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financial Information eXchange) profile applied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K82781208; https://support.f5.com/csp/article/K82781208
CVE: CVE-2019-6668
Published: 2019-11-27
Description: The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5 may allow unprivileged users to access files owned by root.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.f5.com/csp/article/K49827114; https://support.f5.com/csp/article/K49827114
CVE: CVE-2019-6669
Published: 2019-11-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K11447758; https://support.f5.com/csp/article/K11447758
CVE: CVE-2019-6670
Published: 2019-11-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plaintext unit key for their vCMP guests on the filesystem.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-312
References: https://support.f5.com/csp/article/K05765031; https://support.f5.com/csp/article/K05765031
CVE: CVE-2019-6671
Published: 2019-11-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://support.f5.com/csp/article/K39225055; https://support.f5.com/csp/article/K39225055
CVE: CVE-2019-6672
Published: 2019-11-27
Description: On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware-based sPVA, the performance of the BIG-IP AFM system is degraded.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K14703097; https://support.f5.com/csp/article/K14703097
CVE: CVE-2019-6673
Published: 2019-11-27
Description: On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K81557381; https://support.f5.com/csp/article/K81557381
CVE: CVE-2019-18247
Published: 2019-11-27
Description: An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3.18, 2.0.0.11, 2.1.0.1 and prior) to reboot, which could cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.us-cert.gov/ics/advisories/icsa-19-330-02; https://www.us-cert.gov/ics/advisories/icsa-19-330-02
CVE: CVE-2019-18253
Published: 2019-11-27
Description: An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-19-330-01; https://www.us-cert.gov/ics/advisories/icsa-19-330-01
CVE: CVE-2019-18660
Published: 2019-11-27
Description: The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://www.openwall.com/lists/oss-security/2019/11/27/1
CVE: CVE-2019-19319
Published: 2019-11-27
Description: In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://bugzilla.suse.com/show_bug.cgi?id=1158021; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=345c0dbf3a30
CVE: CVE-2019-19318
Published: 2019-11-28
Description: In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318; https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE: CVE-2019-18276
Published: 2019-11-28
Description: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-273, CWE-273
References: http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html; https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2019-19372
Published: 2019-11-28
Description: A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/danielelkabes/Vulnerability-Reports/blob/master/rConfig%203.9.3%20-%20Path%20Traversal%20vulnerability.pdf; https://github.com/danielelkabes/Vulnerability-Reports/blob/master/rConfig%203.9.3%20-%20Path%20Traversal%20vulnerability.pdf
CVE: CVE-2019-19375
Published: 2019-11-28
Description: In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/OctopusDeploy/Issues/issues/5998; https://github.com/OctopusDeploy/Issues/issues/5998
CVE: CVE-2019-19376
Published: 2019-11-28
Description: In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-476
References: https://github.com/OctopusDeploy/Issues/issues/6005; https://github.com/OctopusDeploy/Issues/issues/6005
CVE: CVE-2019-19379
Published: 2019-11-28
Description: In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/MISP/MISP/commit/e05dc512a437284f14624da23cca4a829a76aebf; https://github.com/MISP/MISP/commit/e05dc512a437284f14624da23cca4a829a76aebf
CVE: CVE-2019-19384
Published: 2019-11-29
Description: A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the fax_uuid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/28e7326acfae677be0b351216888e522; https://github.com/fusionpbx/fusionpbx/commit/aea1abaeb12f69dc22967395c528fb2434e316c1; https://gist.github.com/xax007/28e7326acfae677be0b351216888e522
CVE: CVE-2019-19385
Published: 2019-11-29
Description: A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/28e7326acfae677be0b351216888e522; https://github.com/fusionpbx/fusionpbx/commit/fe504b83db80ebae30c982770f0f0b200b88cbe9; https://gist.github.com/xax007/28e7326acfae677be0b351216888e522
CVE: CVE-2019-19386
Published: 2019-11-29
Description: A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemail_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/28e7326acfae677be0b351216888e522; https://github.com/fusionpbx/fusionpbx/commit/9e837fadecdd5199819a949b5b1bd84b19f716f2; https://gist.github.com/xax007/28e7326acfae677be0b351216888e522
CVE: CVE-2019-19387
Published: 2019-11-29
Description: A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/28e7326acfae677be0b351216888e522; https://github.com/fusionpbx/fusionpbx/commit/44edbfe7a7e256d1b[PII_REDACTED]7365a40c92c61; https://gist.github.com/xax007/28e7326acfae677be0b351216888e522
CVE: CVE-2019-19388
Published: 2019-11-29
Description: A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the dialplan_uuid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/xax007/28e7326acfae677be0b351216888e522; https://github.com/fusionpbx/fusionpbx/commit/b584973e73a4d25be623c9748dd9817f69422ecc; https://gist.github.com/xax007/28e7326acfae677be0b351216888e522
CVE: CVE-2019-14865
Published: 2019-11-29
Description: A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-267
References: http://www.openwall.com/lists/oss-security/2024/02/06/3; https://access.redhat.com/errata/RHSA-2020:0335; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14865
CVE: CVE-2019-14895
Published: 2019-11-29
Description: A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection negotiation during the handling of the remote devices country settings. This could allow the remote device to cause a denial of service (system crash) or possibly execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html; http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
CVE: CVE-2019-14897
Published: 2019-11-29
Description: A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html; http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
CVE: CVE-2019-14901
Published: 2019-11-29
Description: A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-400, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html; http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
CVE: CVE-2019-19377
Published: 2019-11-29
Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19377; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19391
Published: 2019-11-29
Description: In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However, not all users of later LuaJIT derivatives share this perspective
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-843
References: https://github.com/LuaJIT/LuaJIT/pull/526; https://github.com/LuaJIT/LuaJIT/pull/526; https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html
CVE: CVE-2019-16766
Published: 2019-11-29
Description: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
CVSS Score: 8.7 (HIGH)
CWE: CWE-290, CWE-304
References: https://github.com/LabD/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm; https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca; https://github.com/labd/wagtail-2fa/commit/a6711b[PII_REDACTED]5770ff481b22675b35ff5c81