deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9116
Published: 2019-02-25
Description: DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublime_text.exe to open a .txt file within an attacker's %LOCALAPPDATA%\Temp\sublime_text folder. NOTE: the vendor's position is "This does not appear to be a bug with Sublime Text, but rather one with Windows that has been patched.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/SublimeTextIssues/Core/issues/2544; https://github.com/SublimeTextIssues/Core/issues/2544
CVE: CVE-2019-9142
Published: 2019-02-25
Description: An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/b3log/symphony/issues/860; https://github.com/b3log/symphony/issues/860
CVE: CVE-2019-9143
Published: 2019-02-25
Description: An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-674
References: http://www.securityfocus.com/bid/107161; https://github.com/Exiv2/exiv2/issues/711; https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2imageprinttiffstructure-exiv2-0-27/
CVE: CVE-2019-9144
Published: 2019-02-25
Description: An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 8.8 (HIGH)
CWE: CWE-674
References: http://www.securityfocus.com/bid/107161; https://github.com/Exiv2/exiv2/issues/712; https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2anonymous-namespacebigtiffimageprintifd-exiv2-0-27/
CVE: CVE-2019-1683
Published: 2019-02-25
Description: A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session Initiation Protocol (SIP) conversation. The vulnerability is due to the improper validation of server certificates. An attacker could exploit this vulnerability by crafting a malicious server certificate to present to the client. An exploit could allow an attacker to eavesdrop on TLS-encrypted traffic and potentially route or redirect calls initiated by an affected device. Affected software include version 7.6.2 of the Cisco Small Business SPA525 Series IP Phones and Cisco Small Business SPA5X5 Series IP Phones and version 1.4.2 of the Cisco Small Business SPA500 Series IP Phones and Cisco Small Business SPA112 Series IP Phones.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/107111; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-ipphone-certs; http://www.securityfocus.com/bid/107111
CVE: CVE-2019-1689
Published: 2019-02-25
Description: A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/107101; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file; http://www.securityfocus.com/bid/107101
CVE: CVE-2019-9145
Published: 2019-02-25
Description: An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cnblogs.com/7bit/articles/10389939.html; https://www.cnblogs.com/7bit/articles/10389939.html
CVE: CVE-2019-9146
Published: 2019-02-25
Description: Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
CVSS Score: 7.5 (HIGH)
References: https://github.com/PAGalaxyLab/VulInfo/blob/master/JAMF/JAMF%20software%20%20local%20permission%20promotion%20vulnerability.md; https://github.com/PAGalaxyLab/VulInfo/blob/master/JAMF/JAMF%20software%20%20local%20permission%20promotion%20vulnerability.md
CVE: CVE-2019-9151
Published: 2019-02-25
Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called from H5D__compact_readvv in H5Dcompact.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/magicSwordsMan/PAAFS/tree/master/vul7; https://github.com/magicSwordsMan/PAAFS/tree/master/vul7
CVE: CVE-2019-9152
Published: 2019-02-25
Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called from H5O_dtype_decode_helper in H5Odtype.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/magicSwordsMan/PAAFS/tree/master/vul8; https://github.com/magicSwordsMan/PAAFS/tree/master/vul8
CVE: CVE-2018-20033
Published: 2019-02-25
Description: A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to corrupt the memory by allocating / deallocating memory, loading lmgrd or the vendor daemon and causing the heartbeat between lmgrd and the vendor daemon to stop. This would force the vendor daemon to shut down. No exploit of this vulnerability has been demonstrated.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-770
References: http://www.securityfocus.com/bid/109155; https://secuniaresearch.flexerasoftware.com/advisories/85979/; https://www.oracle.com/security-alerts/cpuoct2021.html
CVE: CVE-2018-11289
Published: 2019-02-25
Description: Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11820
Published: 2019-02-25
Description: Use of non-time constant memcmp function creates side channel that leaks information and leads to cryptographic issues in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 800, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11845
Published: 2019-02-25
Description: Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in versions MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11864
Published: 2019-02-25
Description: Bytes can be written to fuses from Secure region which can be read later by HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11931
Published: 2019-02-25
Description: Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in versions MDM9150, MDM9206, MDM9607, MDM9650, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11932
Published: 2019-02-25
Description: Improper input validation can lead RW access to secure subsystem from HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9650, MDM9655, MSM8996AU, QCS605, SD 410/12, SD 615/16/SD 415, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SXR1130.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11935
Published: 2019-02-25
Description: Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9607, MDM9650, MDM9655, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11938
Published: 2019-02-25
Description: Improper input validation for argument received from HLOS can lead to buffer overflows and unexpected behavior in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11945
Published: 2019-02-25
Description: Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in versions MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11948
Published: 2019-02-25
Description: Exceeding the limit of usage entries are not tracked and the information will be lost causing the content to lose continuity in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in versions MSM8996AU, QCS605, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-129
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-13900
Published: 2019-02-25
Description: Use-after-free vulnerability will occur as there is no protection for the route table`s rule in IPA driver in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in versions MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106949; https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin; http://www.securityfocus.com/bid/106949
CVE: CVE-2018-13904
Published: 2019-02-25
Description: Improper input validation in SCM handler to access storage in TZ can lead to unauthorized access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 675, SD 712 / SD 710 / SD 670, SD 8CX, SXR1130.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-13905
Published: 2019-02-25
Description: KGSL syncsource lock not handled properly during syncsource cleanup can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, SD 210/SD 212/SD 205, SD 439 / SD 429, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106949; https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin; http://www.securityfocus.com/bid/106949
CVE: CVE-2018-13912
Published: 2019-02-25
Description: Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin
CVE: CVE-2018-13913
Published: 2019-02-25
Description: Improper validation of array index can lead to unauthorized access while processing debugFS in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in version MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin
CVE: CVE-2018-13914
Published: 2019-02-25
Description: Lack of input validation for data received from user space can lead to an out of bound array issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in version MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 636, SD 820A, SD 835, SDM630, SDM660, SDX20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/02/04/february-2019-code-aurora-security-bulletin
CVE: CVE-2018-5839
Published: 2019-02-25
Description: Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in versions MDM9150, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8996AU, QCS605, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SXR1130.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-15777
Published: 2019-02-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2018. Notes: none
CVE: CVE-2018-20063
Published: 2019-02-25
Description: An issue was discovered in Gurock TestRail 5.6.0.3853. An "Unrestricted Upload of File" vulnerability exists in the image-upload form (available in the description editor), allowing remote authenticated users to execute arbitrary code by uploading an image file with an executable extension but a safe Content-Type value, and then accessing it via a direct request to the file in the file-upload directory (if it's accessible according to the server configuration).
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://medium.com/%40vrico315/unrestricted-upload-of-file-with-dangerous-type-in-gurocks-testrail-11d9f4d13688; https://medium.com/%40vrico315/unrestricted-upload-of-file-with-dangerous-type-in-gurocks-testrail-11d9f4d13688
CVE: CVE-2019-6265
Published: 2019-02-25
Description: The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecure implementations which allow remote attackers to execute arbitrary commands and escalate privileges.
CVSS Score: 7.8 (HIGH)
References: https://www.detack.de/en/cve-2019-6265-6266; https://www.detack.de/en/cve-2019-6265-6266
CVE: CVE-2019-6266
Published: 2019-02-25
Description: Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://www.detack.de/en/cve-2019-6265-6266; https://www.detack.de/en/cve-2019-6265-6266
CVE: CVE-2019-9162
Published: 2019-02-25
Description: In the Linux kernel before 4.20.12, net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmp_version and snmp_helper.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc; http://www.securityfocus.com/bid/107159; https://bugs.chromium.org/p/project-zero/issues/detail?id=1776
CVE: CVE-2019-9168
Published: 2019-02-26
Description: WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://woocommerce.wordpress.com/2019/02/20/woocommerce-3-5-5-security-fix-release/; https://woocommerce.wordpress.com/2019/02/20/woocommerce-3-5-5-security-fix-release/
CVE: CVE-2009-5155
Published: 2019-02-26
Description: In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b[PII_REDACTED]0987a0341c018d05d3eea1272; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806