deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-2866
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 8.2 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2867
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2868
Published: 2019-07-23
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23 and 12.1.6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-2869
Published: 2019-07-23
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23 and 12.1.6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-2870
Published: 2019-07-23
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23 and 12.1.6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-2871
Published: 2019-07-23
Description: Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 12.1.6.2.23 and 12.1.6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Data Store. CVSS 3.0 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-2873
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2874
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2875
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2876
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 3.3 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2877
Published: 2019-07-23
Description: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.0 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://security.gentoo.org/glsa/202101-09
CVE: CVE-2019-2878
Published: 2019-07-23
Description: Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HTTP data path subsystems). The supported version that is affected is 8.8.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance Kit (AK). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Sun ZFS Storage Appliance Kit (AK), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Sun ZFS Storage Appliance Kit (AK) accessible data as well as unauthorized read access to a subset of Sun ZFS Storage Appliance Kit (AK) accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-2879
Published: 2019-07-23
Description: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; https://access.redhat.com/errata/RHSA-2019:2484; https://access.redhat.com/errata/RHSA-2019:2511
CVE: CVE-2019-14247
Published: 2019-07-24
Description: The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://sourceforge.net/p/mpg321/bugs/51/; https://sourceforge.net/p/mpg321/bugs/51/
CVE: CVE-2019-14248
Published: 2019-07-24
Description: In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma.c allows a NULL pointer dereference in process_pragma, search_pragma_list, and nasm_set_limit when "%pragma limit" is mishandled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392576; https://bugzilla.nasm.us/show_bug.cgi?id=3392576
CVE: CVE-2019-14249
Published: 2019-07-24
Description: dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with a zero-size section group (SHT_GROUP), as demonstrated by dwarfdump.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://www.securityfocus.com/bid/109380; https://sourceforge.net/p/libdwarf/code/ci/cb7198abde46c2ae29957ad460da6886eaa606ba/tree/libdwarf/dwarf_elf_load_headers.c?diff=99e77c3894877a1dd80b82808d8309eded4e5599; https://sourceforge.net/p/libdwarf/code/merge-requests/4/
CVE: CVE-2019-14250
Published: 2019-07-24
Description: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege escalation (dependant upon conditions), shell code execution and denial-of-service. The component is: pdmlog.dll library. The attack vector is: The attacker must have access to local system (either directly, or remotley).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://packetstormsecurity.com/files/145181/SocuSoft-Co.-Photo-2-Video-Converter-8.0.0-Code-Execution-DoS.html; https://ret2eax.github.io/posts/socusoft-bof.html; https://www.exploit-db.com/exploits/43208/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fixed version is: after commit 48a66c798d.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://jsish.org/fossil/jsi/tktview?name=65c8965977; https://jsish.org/fossil/jsi/tktview?name=65c8965977
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00028.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan() in g3/pbm2g3.c. The attack vector is: Local, the victim must open a specially crafted file. The fixed version is: 1.2.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00016.html; https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00016.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hisiphp/hisiphp/issues/3; https://github.com/hisiphp/hisiphp/issues/3
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-648, CWE-269
References: https://www.youtube.com/watch?v=vOlw2DP9WbE; https://www.youtube.com/watch?v=vOlw2DP9WbE
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injection'). The impact is: It is possible to manipulate gpg-keys or execute commands remotely. The component is: function pgp_exec() phkp.php:98. The attack vector is: HKP-Api: /pks/lookup?search.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/remko/phkp/issues/1; https://github.com/remko/phkp/issues/1
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack vector is: Local, the user should open a specially crafted file. The fixed version is: 1.2.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YH7KTF6IB4LZURQHCOICNVE6YDAIHV62/; https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YH7KTF6IB4LZURQHCOICNVE6YDAIHV62/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-24
Description: marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/basecamp/marginalia/pull/73/; https://github.com/basecamp/marginalia/pull/73/
CVE: CVE-2019-10968
Published: 2019-07-24
Description: Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-477
References: https://www.us-cert.gov/ics/advisories/icsma-19-192-01; https://www.us-cert.gov/ics/advisories/icsma-19-192-01
CVE: CVE-2019-10982
Published: 2019-07-24
Description: Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-192-01; https://www.us-cert.gov/ics/advisories/icsa-19-192-01
CVE: CVE-2019-10992
Published: 2019-07-24
Description: Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclosure due to lacking user input validation for processing project files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-19-192-01; https://www.us-cert.gov/ics/advisories/icsa-19-192-01
CVE: CVE-2019-3591
Published: 2019-07-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.
CVSS Score: 3.9 (LOW)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109377; https://kc.mcafee.com/corporate/index?page=content&id=SB10289; http://www.securityfocus.com/bid/109377
CVE: CVE-2019-3595
Published: 2019-07-24
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is exported and opened on the their machine. In our checks, the user must explicitly allow the code to execute.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/109377; https://kc.mcafee.com/corporate/index?page=content&id=SB10289; http://www.securityfocus.com/bid/109377
CVE: CVE-2019-3485
Published: 2019-07-24
Description: Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/109363; https://community.microfocus.com/t5/Logger/Logger-Release-Notes-6-71/ta-p/1790256?attachment-id=75011; http://www.securityfocus.com/bid/109363
CVE: CVE-2019-3622
Published: 2019-07-24
Description: Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create symbolic links.
CVSS Score: 8.2 (HIGH)
CWE: CWE-552, CWE-552
References: http://www.securityfocus.com/bid/109370; https://kc.mcafee.com/corporate/index?page=content&id=SB10290; http://www.securityfocus.com/bid/109370
CVE: CVE-2019-14262
Published: 2019-07-25
Description: MetadataExtractor 2.1.0 allows stack consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/drewnoakes/metadata-extractor-dotnet/pull/190; https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E; https://github.com/drewnoakes/metadata-extractor-dotnet/pull/190
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-25
Description: serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/dtolnay/serde-yaml/pull/105; https://github.com/dtolnay/serde-yaml/pull/105
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-25
Description: perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483; https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483