deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18369
Published: 2019-10-31
Description: In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/; https://blog.jetbrains.com/blog/2019/10/29/jetbrains-security-bulletin-q3-2019/
CVE: CVE-2019-3419
Published: 2019-10-31
Description: A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker could exploit this vulnerability to build a link to the device and send specific packets to cause a denial of service.
CVSS Score: 5.7 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011542; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011542
CVE: CVE-2019-3421
Published: 2019-10-31
Description: The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011643; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011643
CVE: CVE-2019-12612
Published: 2019-10-31
Description: An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode.
CVSS Score: 7.8 (HIGH)
References: https://www.bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution/; https://www.bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution/
CVE: CVE-2019-16251
Published: 2019-10-31
Description: plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework/; https://wpvulndb.com/vulnerabilities/9932; https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework/
CVE: CVE-2019-18464
Published: 2019-10-31
Description: In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2; https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm; https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
CVE: CVE-2019-18465
Published: 2019-10-31
Description: In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability; https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm; https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability
CVE: CVE-2019-18656
Published: 2019-10-31
Description: Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/ca036e9f86bb5cdb3dac0930ec131e5f35e26c5f; https://github.com/pimcore/pimcore/commit/ca036e9f86bb5cdb3dac0930ec131e5f35e26c5f
CVE: CVE-2019-14356
Published: 2019-10-31
Description: On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: At Coinkite, we’ve already mitigated it, even though we feel strongly that it is not a legitimate issue. In our opinion, it is both unproven (might not even work) and also completely impractical—even if it could be made to work perfectly
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://blog.coinkite.com/noise-troll/; https://github.com/someone42/hardware-bitcoin-wallet/blob/master/pic32/ssd1306.c; https://blog.coinkite.com/noise-troll/
CVE: CVE-2013-1910
Published: 2019-10-31
Description: yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/03/29/4; http://www.securityfocus.com/bid/58533; https://access.redhat.com/security/cve/cve-2013-1910
CVE: CVE-2019-18657
Published: 2019-10-31
Description: ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md; https://github.com/ClickHouse/ClickHouse/pull/6466; https://github.com/ClickHouse/ClickHouse/pull/7526/files
CVE: CVE-2013-1930
Published: 2019-10-31
Description: MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103438.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103459.html; http://www.openwall.com/lists/oss-security/2013/04/06/4
CVE: CVE-2013-1931
Published: 2019-10-31
Description: A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103438.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103459.html; http://www.openwall.com/lists/oss-security/2013/04/06/4
CVE: CVE-2013-1932
Published: 2019-10-31
Description: A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/04/06/4; http://www.securityfocus.com/bid/58893; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1932
CVE: CVE-2013-1934
Published: 2019-10-31
Description: A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2015/dsa-3120; http://www.openwall.com/lists/oss-security/2013/04/09/1; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1934
CVE: CVE-2013-1945
Published: 2019-10-31
Description: ruby193 uses an insecure LD_LIBRARY_PATH setting.
CVSS Score: 3.3 (LOW)
CWE: CWE-829
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1945; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1945
CVE: CVE-2013-1951
Published: 2019-10-31
Description: A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104022.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104027.html; http://security.gentoo.org/glsa/glsa-201310-21.xml
CVE: CVE-2013-2012
Published: 2019-10-31
Description: autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2013/04/25/14; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2012; https://exchange.xforce.ibmcloud.com/vulnerabilities/83827
CVE: CVE-2013-2024
Published: 2019-10-31
Description: OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2013/04/29/13; http://www.securityfocus.com/bid/59320; https://access.redhat.com/security/cve/cve-2013-2024
CVE: CVE-2019-15710
Published: 2019-10-31
Description: An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-19-273; https://fortiguard.com/psirt/FG-IR-19-273
CVE: CVE-2019-18396
Published: 2019-10-31
Description: An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155296/Technicolor-TD5130.2-Remote-Command-Execution.html; https://medium.com/%40c4pt41nnn/cve-2019-18396-command-injection-in-technicolor-router-da5dd2134052; https://www.twitter.com/c4pt41nnn
CVE: CVE-2019-5049
Published: 2019-10-31
Description: An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0818
CVE: CVE-2019-5095
Published: 2019-10-31
Description: An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for issues they do not have permission to view via the Tempo plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0838; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0838
CVE: CVE-2019-5150
Published: 2019-10-31
Description: An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.9 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0940; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0940
CVE: CVE-2019-5151
Published: 2019-10-31
Description: An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0941; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0941
CVE: CVE-2010-2548
Published: 2019-10-31
Description: IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2548; https://security-tracker.debian.org/tracker/CVE-2010-2548
CVE: CVE-2010-2783
Published: 2019-10-31
Description: IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/; http://security.gentoo.org/glsa/glsa-201406-32.xml; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2783
CVE: CVE-2012-6122
Published: 2019-10-31
Description: Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://lists.gnu.org/archive/html/chicken-announce/2013-10/msg00000.html; http://www.openwall.com/lists/oss-security/2013/02/08/2; http://www.openwall.com/lists/oss-security/2013/05/08/3
CVE: CVE-2012-6123
Published: 2019-10-31
Description: Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/02/08/2; https://access.redhat.com/security/cve/cve-2012-6123; https://security-tracker.debian.org/tracker/CVE-2012-6123
CVE: CVE-2012-6124
Published: 2019-10-31
Description: A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-338
References: http://www.openwall.com/lists/oss-security/2013/02/08/2; https://access.redhat.com/security/cve/cve-2012-6124; https://lists.nongnu.org/archive/html/chicken-hackers/2012-02/msg00084.html
CVE: CVE-2012-6125
Published: 2019-10-31
Description: Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/02/08/2; https://access.redhat.com/security/cve/cve-2012-6125; https://lists.nongnu.org/archive/html/chicken-hackers/2012-01/msg00002.html
CVE: CVE-2013-2075
Published: 2019-10-31
Description: Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. NOTE: this issue exists because of an incomplete fix for CVE-2012-6122.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commitdiff%3Bh=[PII_REDACTED]74086b6c86c2e27daf3f740ffec091; http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commitdiff%3Bh=766056cd5f26b1d[PII_REDACTED]49cb534609c113f; http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commitdiff%3Bh=9e[PII_REDACTED]e8a30e5cedbf0abc9cd85a0f6af7
CVE: CVE-2018-3983
Published: 2019-10-31
Description: An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. A specially crafted document can cause an array fetch to return an uninitialized pointer and then performs some arithmetic before writing a value to the result. Usage of this uninitialized pointer can allow an attacker to corrupt heap memory resulting in code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0651; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0651
CVE: CVE-2018-4002
Published: 2019-10-31
Description: An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0671; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0671
CVE: CVE-2018-4031
Published: 2019-10-31
Description: An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without prior sanitization, which results in arbitrary Lua script execution in the kernel. An attacker could send an HTTP request to exploit this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0703; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0703
CVE: CVE-2018-4064
Published: 2019-10-31
Description: An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can cause a unverified device configuration change, resulting in an unverified change of the user password on the device. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0749; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0749
CVE: CVE-2019-13508
Published: 2019-10-31
Description: FreeTDS through 1.1.11 has a Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00067.html; https://usn.ubuntu.com/4173-1/; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00067.html
CVE: CVE-2019-13547
Published: 2019-10-31
Description: Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-01; https://www.zerodayinitiative.com/advisories/ZDI-19-960/; https://www.us-cert.gov/ics/advisories/icsa-19-304-01
CVE: CVE-2019-13551
Published: 2019-10-31
Description: Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotely execute code while posing as an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-19-304-01; https://www.zerodayinitiative.com/advisories/ZDI-19-935/; https://www.zerodayinitiative.com/advisories/ZDI-19-941/
CVE: CVE-2019-16295
Published: 2019-10-31
Description: Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154990/CWP-0.9.8.885-Cross-Site-Scripting.html; https://centos-webpanel.com/changelog-cwp7; http://packetstormsecurity.com/files/154990/CWP-0.9.8.885-Cross-Site-Scripting.html
CVE: CVE-2019-5010
Published: 2019-10-31
Description: An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; https://access.redhat.com/errata/RHSA-2019:3520; https://access.redhat.com/errata/RHSA-2019:3725
CVE: CVE-2019-5023
Published: 2019-10-31
Description: An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9.24-test7, grsecurity official from version grsecurity-3.1-4.9.8[PII_REDACTED]53 to grsecurity-3.1-4.9.24[PII_REDACTED]33, grsecurity unofficial from version v4.9.25-unofficialgrsec to v4.9.74-unofficialgrsec. PaX adds a temp buffer to the read_kmem function, which is never freed when an invalid address is supplied. This results in a memory leakage that can lead to a crash of the system. An attacker needs to induce a read to /dev/kmem using an invalid address to exploit this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-401, CWE-772
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0784; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0784
CVE: CVE-2019-5030
Published: 2019-10-31
Description: A buffer overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro MR1 (7,0,2019,0220). While parsing a document text info container, the TxMasterStyleAtom::parse function is incorrectly checking the bounds corresponding to the number of style levels, causing a vtable pointer to be overwritten, which leads to code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0792; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0792