deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18316
Published: 2018-11-28
Description: Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2017-18317
Published: 2018-11-28
Description: Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU,SD 410/12,SD 820,SD 820A.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2017-18318
Published: 2018-11-28
Description: Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 820A.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-11264
Published: 2018-11-28
Description: Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-11921
Published: 2018-11-28
Description: Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI behavior and create unintended SUI display in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11994
Published: 2018-11-28
Description: SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-11996
Published: 2018-11-28
Description: When a malformed command is sent to the device programmer, an out-of-bounds access can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 600, SD 820, SD 820A, SD 835, SDA660, SDX20, SDX24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-5870
Published: 2018-11-28
Description: While loading a service image, an untrusted pointer dereference can occur in Snapdragon Mobile in versions SD 835, SDA660, SDX24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-5877
Published: 2018-11-28
Description: In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incorrect buffer size in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 600, SD 820, SD 820A, SD 835, SDA660, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-5912
Published: 2018-11-28
Description: Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile, Snapdragon Mobile in MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5916
Published: 2018-11-28
Description: Buffer overread while decoding PDP modify request or network initiated secondary PDP activation in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX20, SXR1130.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-5917
Published: 2018-11-28
Description: Possible buffer overflow in OEM crypto function due to improper input validation in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-5918
Published: 2018-11-28
Description: Possible buffer overflow in DRM Trusted application due to lack of check function return values in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDA845, SDX24, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-14746
Published: 2018-11-28
Description: Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.qnap.com/zh-tw/security-advisory/nas-201811-22; https://www.qnap.com/zh-tw/security-advisory/nas-201811-22
CVE: CVE-2018-14747
Published: 2018-11-28
Description: NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qnap.com/zh-tw/security-advisory/nas-201811-22; https://www.qnap.com/zh-tw/security-advisory/nas-201811-22
CVE: CVE-2018-14748
Published: 2018-11-28
Description: Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.qnap.com/zh-tw/security-advisory/nas-201811-22; https://www.qnap.com/zh-tw/security-advisory/nas-201811-22
CVE: CVE-2018-14749
Published: 2018-11-28
Description: Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.qnap.com/zh-tw/security-advisory/nas-201811-22; https://www.qnap.com/zh-tw/security-advisory/nas-201811-22
CVE: CVE-2018-1584
Published: 2018-11-28
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143497.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106125; https://exchange.xforce.ibmcloud.com/vulnerabilities/143497; https://www.ibm.com/support/docview.wss?uid=ibm10741821
CVE: CVE-2018-17156
Published: 2018-11-28
Description: In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwrite could occur when constructing an ICMP reply packet when using a non-standard value for the net.inet.icmp.quotelen sysctl.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106052; https://security.freebsd.org/advisories/FreeBSD-EN-18:13.icmp.asc; http://www.securityfocus.com/bid/106052
CVE: CVE-2018-12116
Published: 2018-11-28
Description: Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-115
References: https://access.redhat.com/errata/RHSA-2019:1821; https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/; https://security.gentoo.org/glsa/202003-48
CVE: CVE-2018-12120
Published: 2018-11-28
Description: Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.
CVSS Score: 8.1 (HIGH)
CWE: CWE-419, CWE-829
References: http://www.securityfocus.com/bid/106040; https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/; http://www.securityfocus.com/bid/106040
CVE: CVE-2018-12121
Published: 2018-11-28
Description: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/106043; https://access.redhat.com/errata/RHSA-2019:1821; https://access.redhat.com/errata/RHSA-2019:2258
CVE: CVE-2018-12122
Published: 2018-11-28
Description: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/106043; https://access.redhat.com/errata/RHSA-2019:1821; https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
CVE: CVE-2018-12123
Published: 2018-11-28
Description: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-115, CWE-20
References: https://access.redhat.com/errata/RHSA-2019:1821; https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/; https://security.gentoo.org/glsa/202003-48
CVE: CVE-2018-15441
Published: 2018-11-28
Description: A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted HTTP POST requests that contain malicious SQL statements to an affected application. A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/106039; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181128-plm-sql-inject; http://www.securityfocus.com/bid/106039
CVE: CVE-2018-19646
Published: 2018-11-28
Description: The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/45542; https://www.exploit-db.com/exploits/45542
CVE: CVE-2018-5559
Published: 2018-11-28
Description: In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configurations of connection data without obscuring sensitive data from the API response sent over an encrypted channel. This issue does not affect Rapid7 Komand version 0.42.0 and later versions.
CVSS Score: 3.4 (LOW)
CWE: CWE-212, CWE-312
References: https://docs.komand.com/docs/release-notes#section-komand-v0-42-0-2018-11-1; https://www.alexanderjaeger.de/cve-2018-5559_my_first_cve/; https://docs.komand.com/docs/release-notes#section-komand-v0-42-0-2018-11-1
CVE: CVE-2018-19370
Published: 2018-11-28
Description: A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://github.com/Yoast/wordpress-seo/pull/11502/commits/3bfa70a143f5ea3ee1934f3a1703bb5caf139ffa; https://wordpress.org/plugins/wordpress-seo/#developers; https://www.youtube.com/watch?v=nL141dcDGCY
CVE: CVE-2018-19651
Published: 2018-11-28
Description: admin/functions/remote.php in Interspire Email Marketer through 6.1.6 has Server Side Request Forgery (SSRF) via a what=importurl&url= request with an http or https URL. This also allows reading local files with a file: URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://medium.com/%40namhb/ssrf-to-lfi-in-interspire-email-marketer-698a748462a9; https://medium.com/%40namhb/ssrf-to-lfi-in-interspire-email-marketer-698a748462a9
CVE: CVE-2018-17930
Published: 2018-11-28
Description: A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/105967; https://ics-cert.us-cert.gov/advisories/ICSA-18-324-01%2C; https://www.teledynedalsa.com/en/products/imaging/vision-software/sherlock/
CVE: CVE-2018-18203
Published: 2018-11-28
Description: A vulnerability in the update mechanism of Subaru StarLink Harman head units 2017, 2018, and 2019 may give an attacker (with physical access to the vehicle's USB ports) the ability to rewrite the firmware of the head unit. This occurs because the device accepts modified QNX6 filesystem images (as long as the attacker obtains access to certain Harman decryption/encryption code) as a consequence of a bug where unsigned images pass a validity check. An attacker could potentially install persistent malicious head unit firmware and execute arbitrary code as the root user.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-347
References: https://github.com/sgayou/subaru_starlink_research; https://github.com/sgayou/subaru_starlink_research
CVE: CVE-2018-19622
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
CVE: CVE-2018-19623
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
CVE: CVE-2018-19624
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
CVE: CVE-2018-19625
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
CVE: CVE-2018-19626
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
CVE: CVE-2018-19627
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
CVE: CVE-2018-19628
Published: 2018-11-29
Description: In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; http://www.securityfocus.com/bid/106051; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
CVE: CVE-2018-19654
Published: 2018-11-29
Description: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a duplicate username, as demonstrated by use of the test%c2 string when a test account already exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/Venan24/SCMS/issues/1; https://github.com/Venan24/SCMS/issues/1
CVE: CVE-2018-19655
Published: 2018-11-29
Description: A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/
CVE: CVE-2018-19661
Published: 2018-11-29
Description: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/erikd/libsndfile/issues/429; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE: CVE-2018-19662
Published: 2018-11-29
Description: An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that will lead to a denial of service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/erikd/libsndfile/issues/429; https://lists.debian.org/debian-lts-announce/2018/12/msg00016.html; https://lists.debian.org/debian-lts-announce/2020/10/msg00030.html
CVE: CVE-2018-19664
Published: 2018-11-29
Description: libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/305; https://usn.ubuntu.com/4190-1/; https://github.com/libjpeg-turbo/libjpeg-turbo/issues/305
CVE: CVE-2018-19666
Published: 2018-11-29
Description: The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/ossec/ossec-hids/issues/1585; https://github.com/ossec/ossec-hids/issues/1585