deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13359
Published: 2019-07-16
Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/153666/CentOS-Control-Web-Panel-0.9.8.836-Privilege-Escalation.html; https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13359.md; http://packetstormsecurity.com/files/153666/CentOS-Control-Web-Panel-0.9.8.836-Privilege-Escalation.html
CVE: CVE-2019-6160
Published: 2019-07-16
Description: A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
CVSS Score: 8.8 (HIGH)
References: https://support.lenovo.com/solutions/LEN-25557; https://support.lenovo.com/solutions/LEN-25557
CVE: CVE-2019-9700
Published: 2019-07-16
Description: Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVSS Score: 3.9 (LOW)
References: https://support.symantec.com/us/en/article.SYMSA1483.html; https://support.symantec.com/us/en/article.SYMSA1483.html
CVE: CVE-2019-3571
Published: 2019-07-16
Description: An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116, CWE-20
References: https://www.facebook.com/security/advisories/cve-2019-3571; https://www.facebook.com/security/advisories/cve-2019-3571
CVE: CVE-2019-13623
Published: 2019-07-17
Description: In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://blog.fxiao.me/ghidra/; http://packetstormsecurity.com/files/154015/Ghidra-Linux-9.0.4-Arbitrary-Code-Execution.html; https://ghidra-sre.org/releaseNotes_9.1_final.html
CVE: CVE-2019-13624
Published: 2019-07-17
Description: In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: https://gerrit.onosproject.org/#/c/20767/; https://gerrit.onosproject.org/#/c/20767/
CVE: CVE-2019-13625
Published: 2019-07-17
Description: NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://blog.fxiao.me/ghidra/; https://github.com/NationalSecurityAgency/ghidra/issues/71; https://xlab.tencent.com/en/2019/03/18/ghidra-from-xxe-to-rce/
CVE: CVE-2019-13446
Published: 2019-07-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-9848
Published: 2019-07-17
Description: LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html; http://www.securityfocus.com/bid/109374
CVE: CVE-2019-9849
Published: 2019-07-17
Description: LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html; http://www.securityfocus.com/bid/109374
CVE: CVE-2019-13272
Published: 2019-07-17
Description: In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/153663/Linux-PTRACE_TRACEME-Broken-Permission-Object-Lifetime-Handling.html; http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html
CVE: CVE-2018-1921
Published: 2019-07-17
Description: IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152857.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/152857; https://www.ibm.com/support/docview.wss?uid=ibm10887995; https://exchange.xforce.ibmcloud.com/vulnerabilities/152857
CVE: CVE-2018-2021
Published: 2019-07-17
Description: IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155345.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/155345; https://www.ibm.com/support/docview.wss?uid=ibm10888117; https://exchange.xforce.ibmcloud.com/vulnerabilities/155345
CVE: CVE-2018-2022
Published: 2019-07-17
Description: IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 155346.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/155346; https://www.ibm.com/support/docview.wss?uid=ibm10888133; https://exchange.xforce.ibmcloud.com/vulnerabilities/155346
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2[PII_REDACTED].
CVSS Score: 7.5 (HIGH)
References: https://www.palletsprojects.com/blog/flask-1-0-released/; https://www.palletsprojects.com/blog/flask-1-0-released/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is: Incorrect calls to _ensure_auth() wrapper result in authentication-checking not being applied to al routes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109; https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109
CVE: CVE-2019-4054
Published: 2019-07-17
Description: IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further attacks against the system. IBM X-Force ID: 156563.
CVSS Score: 3.3 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156563; https://www.ibm.com/support/docview.wss?uid=ibm10957139; https://exchange.xforce.ibmcloud.com/vulnerabilities/156563
CVE: CVE-2019-4194
Published: 2019-07-17
Description: IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10885989; https://exchange.xforce.ibmcloud.com/vulnerabilities/159033; http://www.ibm.com/support/docview.wss?uid=ibm10885989
CVE: CVE-2019-4211
Published: 2019-07-17
Description: IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159131.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159131; https://www.ibm.com/support/docview.wss?uid=ibm10957143; https://exchange.xforce.ibmcloud.com/vulnerabilities/159131
CVE: CVE-2019-4430
Published: 2019-07-17
Description: IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162887.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162887; https://www.ibm.com/support/docview.wss?uid=ibm10959173; https://exchange.xforce.ibmcloud.com/vulnerabilities/162887
CVE: CVE-2019-13453
Published: 2019-07-17
Description: Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://www.securityfocus.com/bid/109282; https://lists.debian.org/debian-lts-announce/2022/05/msg00041.html; https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-2-of-3/
CVE: CVE-2019-10352
Published: 2019-07-17
Description: A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2019/07/17/2; http://www.securityfocus.com/bid/109299; https://access.redhat.com/errata/RHSA-2019:2503
CVE: CVE-2019-10353
Published: 2019-07-17
Description: CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/07/17/2; http://www.securityfocus.com/bid/109373; https://access.redhat.com/errata/RHSA-2019:2503
CVE: CVE-2019-10354
Published: 2019-07-17
Description: A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/07/17/2; http://www.securityfocus.com/bid/109373; https://access.redhat.com/errata/RHSA-2019:2503
CVE: CVE-2019-13573
Published: 2019-07-17
Description: A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-097; https://plugins.trac.wordpress.org/changeset/2121566/fv-wordpress-flowplayer/trunk/models/db.php; https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
CVE: CVE-2019-13626
Published: 2019-07-17
Description: SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00093.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00094.html; https://bugzilla.libsdl.org/show_bug.cgi?id=4522
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tinymce/tinymce/issues/4394; https://github.com/tinymce/tinymce/issues/4394
CVE: CVE-2019-12175
Published: 2019-07-17
Description: In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/zeek/zeek/releases/tag/v2.6.2; https://github.com/zeek/zeek/releases/tag/v2.6.2
CVE: CVE-2019-12475
Published: 2019-07-17
Description: In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.microstrategy.com/s/article/Defects-and-Enhancements-Addressed-in-MicroStrategy-10-4-6-Secure-Enterprise-Platform?language=en_US; https://github.com/undefinedmode/CVE-2019-12475; https://community.microstrategy.com/s/article/Defects-and-Enhancements-Addressed-in-MicroStrategy-10-4-6-Secure-Enterprise-Platform?language=en_US
CVE: CVE-2019-13346
Published: 2019-07-17
Description: In MyT 1.5.1, the User[username] parameter has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/47109; https://www.exploit-db.com/exploits/47109
CVE: CVE-2019-13403
Published: 2019-07-17
Description: Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
CVSS Score: 7.5 (HIGH)
References: https://github.com/B3Bo1d/CVE-2019-13403/; https://github.com/B3Bo1d/CVE-2019-13403/
CVE: CVE-2019-13613
Published: 2019-07-17
Description: CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13613/; https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13613/
CVE: CVE-2019-13614
Published: 2019-07-17
Description: CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13614/; https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13614/
CVE: CVE-2019-13584
Published: 2019-07-17
Description: The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153672/FANUC-Robotics-Virtual-Robot-Controller-8.23-Path-Traversal.html; https://seclists.org/bugtraq/2019/Jul/23; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-025.txt
CVE: CVE-2019-13585
Published: 2019-07-17
Description: The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/153671/FANUC-Robotics-Virtual-Robot-Controller-8.23-Buffer-Overflow.html; https://seclists.org/bugtraq/2019/Jul/24; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-024.txt
CVE: CVE-2019-13631
Published: 2019-07-17
Description: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html; http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-11535
Published: 2019-07-17
Description: Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An attacker can access system OS configurations and commands that are not intended for use beyond the web UI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/Linksys%20RE6300%20RE6400%20Firmware%20Release%20Notes_v1.2.05.001.txt; http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/Linksys%20RE6300%20RE6400%20Firmware%20Release%20Notes_v1.2.05.001.txt
CVE: CVE-2019-12876
Published: 2019-07-17
Description: Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/109298; https://www.criticalstart.com/2019/07/manageengine-privilege-escalation/; http://www.securityfocus.com/bid/109298
CVE: CVE-2019-13447
Published: 2019-07-17
Description: An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/; https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/
CVE: CVE-2019-13448
Published: 2019-07-17
Description: An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/; https://cyberoo.com/2019/07/16/cyberoo-identifica-vulnerabilita-0day/
CVE: CVE-2019-13493
Published: 2019-07-17
Description: In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.html
CVE: CVE-2019-13577
Published: 2019-07-17
Description: SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on Port 987.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://hyp3rlinx.altervista.org; http://packetstormsecurity.com/files/153675/MAPLE-Computer-WBT-SNMP-Administrator-2.0.195.15-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2019/Jul/17
CVE: CVE-2019-13619
Published: 2019-07-17
Description: In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00068.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/109293
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b[PII_REDACTED]207c2152d6c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/DCIT/perl-Crypt-JWT/commit/b98a59b42ded9f9e51b[PII_REDACTED]207c2152d6c; https://www.openwall.com/lists/oss-security/2018/09/07/1; https://github.com/DCIT/perl-Crypt-JWT/commit/b98a59b42ded9f9e51b[PII_REDACTED]207c2152d6c
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/lodash/lodash/issues/3359; https://github.com/lodash/lodash/wiki/Changelog; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-17
Description: helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://github.com/helm/helm/pull/3152; https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50; https://github.com/helm/helm/releases/tag/v2.7.2