deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10072
Published: 2019-06-21
Description: The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html; http://www.securityfocus.com/bid/108874; https://access.redhat.com/errata/RHSA-2019:3929
CVE: CVE-2019-10270
Published: 2019-06-21
Description: An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the user_id, which is publicly available. One just has to intercept the password modification request and modify user_id. It is possible to modify the passwords for any users or admin WordPress Ultimate Members. This could lead to account compromise and privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-11011
Published: 2019-06-21
Description: Akamai CloudTest before 58.30 allows remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://blogs.akamai.com/sitr/2019/06/cloudtest-vulnerability-cve-2019-11011.html; https://blogs.akamai.com/sitr/2019/06/cloudtest-vulnerability-cve-2019-11011.html
CVE: CVE-2019-12572
Published: 2019-06-21
Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. On startup, the PIA Windows service (pia-service.exe) loads the OpenSSL library from %PROGRAMFILES%\Private Internet Access\libeay32.dll. This library attempts to load the C:\etc\ssl\openssl.cnf configuration file which does not exist. By default on Windows systems, authenticated users can create directories under C:\. A low privileged user can create a C:\etc\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine library resulting in arbitrary code execution as SYSTEM when the service starts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/; https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12572.txt; https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/
CVE: CVE-2019-10718
Published: 2019-06-21
Description: BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html; https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks; http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html
CVE: CVE-2019-10719
Published: 2019-06-21
Description: BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2019/Jun/26; https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
CVE: CVE-2019-10720
Published: 2019-06-21
Description: BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153348/BlogEngine.NET-3.3.6-3.3.7-Theme-Cookie-Directory-Traversal-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2019/Jun/26; https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
CVE: CVE-2019-11392
Published: 2019-06-21
Description: BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks; https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks
CVE: CVE-2019-10028
Published: 2019-06-21
Description: Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2019-002.md; https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2019-002.md
CVE: CVE-2019-12933
Published: 2019-06-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-11877. Reason: This candidate is a duplicate of CVE-2019-11877. Notes: All CVE users should reference CVE-2019-11877 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12935
Published: 2019-06-23
Description: Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153145/Shopware-5.5.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/Jun/32; https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware/
CVE: CVE-2019-12936
Published: 2019-06-23
Description: BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]91-Release-Notes; https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]71; https://support.bluestacks.com/hc/en-us/articles/[PII_REDACTED]91-Release-Notes
CVE: CVE-2019-12937
Published: 2019-06-23
Description: apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-gsudo.c; https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-gsudo.c
CVE: CVE-2019-12928
Published: 2019-06-24
Description: The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-668
References: https://fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928/; https://fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928/
CVE: CVE-2019-12929
Published: 2019-06-24
Description: The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-668
References: https://fakhrizulkifli.github.io/posts/2019/06/06/CVE-2019-12929/; https://fakhrizulkifli.github.io/posts/2019/06/06/CVE-2019-12929/
CVE: CVE-2019-12938
Published: 2019-06-24
Description: The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-693
References: https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak; https://poste.io/changelog; https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak
CVE: CVE-2019-12871
Published: 2019-06-24
Description: An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to a Use-After-Free and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://cert.vde.com/en-us/advisories/vde-2019-014; https://www.zerodayinitiative.com/advisories/ZDI-19-578/; https://cert.vde.com/en-us/advisories/vde-2019-014
CVE: CVE-2019-11647
Published: 2019-06-24
Description: A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p2/data/release-notes-sspr-44-p2.html; https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p2/data/release-notes-sspr-44-p2.html
CVE: CVE-2019-11648
Published: 2019-06-24
Description: An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability could be exploited to expose sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p2/data/release-notes-sspr-44-p2.html; https://www.netiq.com/documentation/self-service-password-reset-44/release-notes-sspr-44-p2/data/release-notes-sspr-44-p2.html
CVE: CVE-2019-12292
Published: 2019-06-24
Description: Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
References: https://support.citrix.com/article/CTX253828; https://support.citrix.com/search?searchQuery=%2A&lang=en&sort=relevance&prod=&pver=&ct=Security+Bulletin; https://support.citrix.com/article/CTX253828
CVE: CVE-2019-12323
Published: 2019-06-24
Description: The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://hyp3rlinx.altervista.org; http://seclists.org/fulldisclosure/2019/Jun/28; https://help.hostingcontroller.com/OnlineHelp/default.aspx?pageid=hc_release_notes
CVE: CVE-2019-12384
Published: 2019-06-24
Description: FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:1820; https://access.redhat.com/errata/RHSA-2019:2720; https://access.redhat.com/errata/RHSA-2019:2858
CVE: CVE-2019-12869
Published: 2019-06-24
Description: An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Out-Of-Bounds Read, Information Disclosure, and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://cert.vde.com/en-us/advisories/vde-2019-014; https://www.zerodayinitiative.com/advisories/ZDI-19-579/; https://cert.vde.com/en-us/advisories/vde-2019-014
CVE: CVE-2019-12870
Published: 2019-06-24
Description: An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Uninitialized Pointer and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation, the attacker needs to exchange the original file with the manipulated one on the application programming workstation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-824
References: https://cert.vde.com/en-us/advisories/vde-2019-014; https://www.zerodayinitiative.com/advisories/ZDI-19-575/; https://cert.vde.com/en-us/advisories/vde-2019-014
CVE: CVE-2019-12939
Published: 2019-06-24
Description: LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/108890; https://forums.livezilla.net/index.php?/topic/10980-fg-vd-19-082-livezilla-server-is-vulnerable-to-sql-injection/; http://www.securityfocus.com/bid/108890
CVE: CVE-2019-12940
Published: 2019-06-24
Description: LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php via a large integer value of the depth parameter.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://forums.livezilla.net/index.php?/topic/10981-fg-vd-19-084-livezilla-server-is-vulnerable-to-denial-of-service/; https://forums.livezilla.net/index.php?/topic/10981-fg-vd-19-084-livezilla-server-is-vulnerable-to-denial-of-service/
CVE: CVE-2018-20843
Published: 2019-06-24
Description: In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226; https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes
CVE: CVE-2019-7230
Published: 2019-06-24
Description: The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: http://packetstormsecurity.com/files/153386/ABB-IDAL-FTP-Server-Uncontrolled-Format-String.html; http://seclists.org/fulldisclosure/2019/Jun/33; http://seclists.org/fulldisclosure/2019/Jun/33
CVE: CVE-2019-7232
Published: 2019-06-24
Description: The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/153403/ABB-IDAL-HTTP-Server-Stack-Based-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2019/Jun/40; http://seclists.org/fulldisclosure/2019/Jun/40
CVE: CVE-2019-7229
Published: 2019-06-24
Description: The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.
CVSS Score: 8.3 (HIGH)
CWE: CWE-494
References: http://packetstormsecurity.com/files/153387/ABB-HMI-Missing-Signature-Verification.html; http://seclists.org/fulldisclosure/2019/Jun/34; http://seclists.org/fulldisclosure/2019/Jun/34
CVE: CVE-2019-9085
Published: 2019-06-24
Description: Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contratto.php with invalid arguments (any non-numeric value), as demonstrated by the anno=2019&id_transazione=1&numero_contratto=1&n_file=a query string to visualizza_contratto.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.hoteldruid.com/en/download.html; https://metamorfosec.com/Files/Advisories/METS-2019-006-An_Invalid_Arguments_in_Hoteldruid_before_v2.3.1.txt; http://www.hoteldruid.com/en/download.html
CVE: CVE-2017-17945
Published: 2019-06-24
Description: The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: http://firstsight.me/2017/12/lack-of-binary-protection-at-asus-vivo-baby-and-hivivo-for-android-that-could-result-of-several-security-issues; http://firstsight.me/2017/12/lack-of-binary-protection-at-asus-vivo-baby-and-hivivo-for-android-that-could-result-of-several-security-issues
CVE: CVE-2019-10271
Published: 2019-06-24
Description: An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. To perform such a modification, one first needs to (for example) intercept an upload-picture request and modify the user_id parameter.
CVSS Score: 4.3 (MEDIUM)
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-12880
Published: 2019-06-24
Description: BCN Quark Quarking Password Manager 3.1.84 suffers from a clickjacking vulnerability caused by allowing * within web_accessible_resources. An attacker can take advantage of this vulnerability and cause significant harm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://packetstormsecurity.com/files/153405/Quarking-Password-Manager-3.1.84-Clickjacking.html; http://seclists.org/fulldisclosure/2019/Jun/31; https://chrome.google.com/webstore/detail/quarking-password-manager/gfkmpfajamepgekgohcdnjogmeamcdmm?hl=en
CVE: CVE-2019-9957
Published: 2019-06-24
Description: Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The XSS payload is stored by creating a new user account, and setting the username to an XSS payload. The stored payload can then be triggered by accessing the "Set Security Levels" or "View User/Group Relationships" page. If the attacker does not currently have permission to create a new user, another vulnerability such as CSRF must be exploited first.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://crawl3r.xyz/cve/cve-2019-9957/; https://crawl3r.xyz/cve/cve-2019-9957/
CVE: CVE-2019-9958
Published: 2019-06-24
Description: CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new admin accounts by crafting a malicious web page that issues specific requests, using a target admin's session to process their requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://crawl3r.xyz/cve/cve-2019-9958/; https://crawl3r.xyz/cve/cve-2019-9958/
CVE: CVE-2019-7231
Published: 2019-06-24
Description: The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer, causing an exception that terminates the server.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153395/ABB-IDAL-FTP-Server-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2019/Jun/35; http://www.securityfocus.com/bid/108886
CVE: CVE-2014-9699
Published: 2019-06-24
Description: The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers through this HTTP server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://secur3.us/index.php/vulnerabilities/; https://support.makerbot.com/learn/makerbot-desktop-software/release-notes/makerbot-desktop-release-notes_13520; https://secur3.us/index.php/vulnerabilities/
CVE: CVE-2019-12346
Published: 2019-06-24
Description: In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/9397; https://zeroauth.ltd/blog/2019/05/27/cve-2019-12346-miniorange-saml-sp-single-sign-on-wordpress-plugin-xss/; https://wpvulndb.com/vulnerabilities/9397
CVE: CVE-2019-10689
Published: 2019-06-24
Description: VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/108799; https://support.polycom.com/content/dam/polycom-support/global/documentation/insufficient-authentication-leakage-vvx-products.pdf; http://www.securityfocus.com/bid/108799
CVE: CVE-2019-12951
Published: 2019-06-24
Description: An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb; https://github.com/cesanta/mongoose/releases/tag/6.15; https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb
CVE: CVE-2019-12957
Published: 2019-06-25
Description: In Xpdf 4.01.01, a buffer over-read could be triggered in FoFiType1C::convertToType1 in fofi/FoFiType1C.cc when the index number is larger than the charset array bounds. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-129
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41813; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/