deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5558
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5559
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5560
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5561
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5562
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5563
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5564
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5565
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5566
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5567
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5568
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5569
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5570
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5571
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5572
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5573
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5574
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5575
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5576
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5577
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5578
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5579
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5580
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5581
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5582
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5583
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5584
Published: 2019-12-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-7488
Published: 2019-12-23
Description: Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255, CWE-521
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0014; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0014
CVE: CVE-2019-7489
Published: 2019-12-23
Description: A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0023; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0023
CVE: CVE-2019-8293
Published: 2019-12-23
Description: Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.openwall.com/lists/oss-security/2019/12/23/2; https://github.com/abcprintf/upload-image-with-ajax/commit/71436ba[PII_REDACTED]519d4b25ea57591cfb4974c; http://www.openwall.com/lists/oss-security/2019/12/23/2
CVE: CVE-2018-10387
Published: 2019-12-23
Description: Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2008-2161.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/; https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE: CVE-2018-10388
Published: 2019-12-23
Description: Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/; https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE: CVE-2018-10389
Published: 2019-12-23
Description: Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/; https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE: CVE-2019-12567
Published: 2019-12-23
Description: Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12568.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/; https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE: CVE-2019-12568
Published: 2019-12-23
Description: Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12567.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/; https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/
CVE: CVE-2019-18211
Published: 2019-12-23
Description: An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/Orckestra/C1-CMS-Foundation/commits/dev; https://github.com/Orckestra/C1-CMS-Foundation/commits/dev
CVE: CVE-2019-19947
Published: 2019-12-24
Description: In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-908
References: http://www.openwall.com/lists/oss-security/2019/12/24/1; https://github.com/torvalds/linux/commit/da2311a6385c3b499da2ed5d9be59ce331fa93e9; https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
CVE: CVE-2019-19948
Published: 2019-12-24
Description: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00006.html; https://github.com/ImageMagick/ImageMagick/issues/1562; https://lists.debian.org/debian-lts-announce/2019/12/msg00033.html
CVE: CVE-2019-19949
Published: 2019-12-24
Description: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00006.html; https://github.com/ImageMagick/ImageMagick/issues/1561; https://lists.debian.org/debian-lts-announce/2019/12/msg00033.html
CVE: CVE-2019-19950
Published: 2019-12-24
Description: In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/44ab7f6c20b4; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00064.html
CVE: CVE-2019-19951
Published: 2019-12-24
Description: In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/bc99af93614d; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00064.html
CVE: CVE-2019-19952
Published: 2019-12-24
Description: In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to ReadOneMNGImage.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/ImageMagick/ImageMagick/issues/1791; https://github.com/ImageMagick/ImageMagick/issues/1791
CVE: CVE-2019-19953
Published: 2019-12-24
Description: In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/28f8bacd4bbf; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00064.html
CVE: CVE-2017-16778
Published: 2019-12-24
Description: An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to invoke an access grant that would allow physical access to a restricted floor/level. By design, only a residential unit owner may allow such an access grant. However, due to incorrect access control, an attacker could inject it via the speaker unit to perform an access grant to gain unauthorized access, as demonstrated by a loud DTMF tone representing '1' and a long '#' (697 Hz and 1209 Hz, followed by 941 Hz and 1477 Hz).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: https://github.com/breaktoprotect/CVE-2017-16778-Intercom-DTMF-Injection; https://github.com/breaktoprotect/CVE-2017-16778-Intercom-DTMF-Injection
CVE: CVE-2019-19695
Published: 2019-12-24
Description: A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to create a symbolic link to a target file and modify it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124055.aspx; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124055.aspx
CVE: CVE-2019-18249
Published: 2019-12-24
Description: Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26.4), may allow attacker to execute commands on behalf of the user when an authenticated user clicks on a malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.us-cert.gov/ics/advisories/icsa-19-353-04; https://www.us-cert.gov/ics/advisories/icsa-19-353-04
CVE: CVE-2019-19954
Published: 2019-12-24
Description: Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://blog.mirch.io/2019/12/18/signal-desktop-windows-lpe/; https://github.com/signalapp/Signal-Desktop/commit/2da39cca673cc11be3c6d70d4fb95889f9ab6688; https://blog.mirch.io/2019/12/18/signal-desktop-windows-lpe/
CVE: CVE-2019-19923
Published: 2019-12-24
Description: flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
CVE: CVE-2019-19924
Published: 2019-12-24
Description: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2019-19956
Published: 2019-12-24
Description: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-772
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html; https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf
CVE: CVE-2019-19925
Published: 2019-12-24
Description: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
CVE: CVE-2019-10758
Published: 2019-12-24
Description: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215; https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758
CVE: CVE-2019-19957
Published: 2019-12-24
Description: In libIEC61850 1.4.0, getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of-bounds read vulnerability, related to bufPos and elementLength.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/mz-automation/libiec61850/issues/197; https://github.com/mz-automation/libiec61850/issues/197
CVE: CVE-2019-19958
Published: 2019-12-24
Description: In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an integer signedness issue that could lead to an attempted excessive memory allocation and denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-681, CWE-770
References: https://github.com/mz-automation/libiec61850/issues/198; https://github.com/mz-automation/libiec61850/issues/198
CVE: CVE-2019-5702
Published: 2019-12-24
Description: NVIDIA GeForce Experience, all versions prior to 3.20.2, contains a vulnerability when GameStream is enabled in which an attacker with local system access can corrupt a system file, which may lead to denial of service or escalation of privileges.
CVSS Score: 7.8 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4954; https://nvidia.custhelp.com/app/answers/detail/a_id/4954
CVE: CVE-2019-19960
Published: 2019-12-25
Description: In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/wolfSSL/wolfssl/commit/5ee9f9c7a23f8ed093fe1e42bc540727e96cebb8; https://github.com/wolfSSL/wolfssl/releases/tag/v4.3.0-stable; https://github.com/wolfSSL/wolfssl/commit/5ee9f9c7a23f8ed093fe1e42bc540727e96cebb8
CVE: CVE-2019-19962
Published: 2019-12-25
Description: wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/wolfSSL/wolfssl/commit/23878512c65834d12811b1107d19a001478eca5d; https://github.com/wolfSSL/wolfssl/releases/tag/v4.3.0-stable; https://github.com/wolfSSL/wolfssl/commit/23878512c65834d12811b1107d19a001478eca5d
CVE: CVE-2019-19963
Published: 2019-12-25
Description: An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/wolfSSL/wolfssl/commit/7e391f0fd57f2ef375b1174d752a56ce34b2b190; https://github.com/wolfSSL/wolfssl/releases/tag/v4.3.0-stable; https://github.com/wolfSSL/wolfssl/commit/7e391f0fd57f2ef375b1174d752a56ce34b2b190
CVE: CVE-2019-19965
Published: 2019-12-25
Description: In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f70267f379b5e5e11bdc5d72a56bf17e5feed01f; https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html
CVE: CVE-2019-19966
Published: 2019-12-25
Description: In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.6; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dea37a97265588da604c6ba80160a287b72c7bfd
CVE: CVE-2019-19967
Published: 2019-12-25
Description: The Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6-NOSH devices accepts a cleartext password in a POST request on port 80, as demonstrated by the Password field to the xml/setter.xml URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/filipi86/ConnectBoxDOCSIS-3.0; https://github.com/filipi86/ConnectBoxDOCSIS-3.0
CVE: CVE-2018-18288
Published: 2019-12-26
Description: CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.crushftp.com/version8_build.html; https://www.crushftp.com/version8_build.html
CVE: CVE-2019-19977
Published: 2019-12-26
Description: libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/Kirin-say/Vulnerabilities/blob/master/Stack_Overflow_in_libesmtp.md; https://github.com/jbouse-debian/libesmtp/blob/ca5bd0800ef1da234315da4c59716568eb5e6402/ntlm/ntlmstruct.c#L228-L242; https://web.archive.org/web/[PII_REDACTED]5510/http://brianstafford.info/libesmtp/