deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7838
Published: 2019-06-12
Description: ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html; https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html
CVE: CVE-2019-7839
Published: 2019-06-12
Description: ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153439/Coldfusion-JNBridge-Remote-Code-Execution.html; https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html; https://seclists.org/bugtraq/2019/Jun/38
CVE: CVE-2019-7840
Published: 2019-06-12
Description: ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html; https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html
CVE: CVE-2019-7845
Published: 2019-06-12
Description: Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2019:1476; https://helpx.adobe.com/security/products/flash-player/apsb19-30.html; https://security.gentoo.org/glsa/201908-21
CVE: CVE-2019-0311
Published: 2019-06-12
Description: Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2728153; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2728153
CVE: CVE-2019-0312
Published: 2019-06-12
Description: Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50) are not password protected. An attacker could access landscape information like host names, ports or other technical data in the absence of restrictive firewall and port settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/2744086; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2744086
CVE: CVE-2019-0314
Published: 2019-06-12
Description: SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 5.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2793805; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2793805
CVE: CVE-2019-0315
Published: 2019-06-12
Description: Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 and SAP_XIPCK 7.10 to 7.11, 7.20, 7.30) allows an attacker to access passwords used in FTP channels leading to information disclosure.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2755438; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242; https://launchpad.support.sap.com/#/notes/2755438
CVE: CVE-2018-12147
Published: 2019-06-13
Description: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html?wapkw=2018-12147; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html
CVE: CVE-2018-3702
Published: 2019-06-13
Description: Improper permissions in the installer for the ITE Tech* Consumer Infrared Driver for Windows 10 versions before 5.4.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/108782; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00206.html; http://www.securityfocus.com/bid/108782
CVE: CVE-2019-0128
Published: 2019-06-13
Description: Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.45 may allow an authenticated user to escalate privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/108767; https://support.lenovo.com/us/en/product_security/LEN-27840; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00224.html
CVE: CVE-2019-0130
Published: 2019-06-13
Description: Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108775; https://support.lenovo.com/us/en/product_security/LEN-27843; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html
CVE: CVE-2019-0136
Published: 2019-06-13
Description: Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 7.4 (HIGH)
References: http://jvn.jp/en/jp/JVN75617741/index.html; http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html; http://www.securityfocus.com/bid/108777
CVE: CVE-2019-0157
Published: 2019-06-13
Description: Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108771; https://support.f5.com/csp/article/K10244523; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00235.html
CVE: CVE-2019-0164
Published: 2019-06-13
Description: Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/108770; https://support.lenovo.com/us/en/product_security/LEN-27841; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00243.html
CVE: CVE-2019-0174
Published: 2019-06-13
Description: Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.
CVSS Score: 3.3 (LOW)
References: http://www.securityfocus.com/bid/108731; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K18165180
CVE: CVE-2019-0175
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0177
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/in; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/in
CVE: CVE-2019-0178
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.6 (LOW)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0179
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0180
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0181
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0182
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-0183
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 3.3 (LOW)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-11092
Published: 2019-06-13
Description: Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html
CVE: CVE-2019-11117
Published: 2019-06-13
Description: Improper permissions in the installer for Intel(R) Omni-Path Fabric Manager GUI before version 10.9.2.1.1 may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/108788; https://www.intel.com/content/www/us/en/security-center/advisory/in; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00257.html
CVE: CVE-2019-11119
Published: 2019-06-13
Description: Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/108780; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00259.html; http://www.securityfocus.com/bid/108780
CVE: CVE-2019-11123
Published: 2019-06-13
Description: Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-11124
Published: 2019-06-13
Description: Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-11125
Published: 2019-06-13
Description: Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-11126
Published: 2019-06-13
Description: Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-11127
Published: 2019-06-13
Description: Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-11128
Published: 2019-06-13
Description: Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/in; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html
CVE: CVE-2019-11129
Published: 2019-06-13
Description: Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://www.securityfocus.com/bid/108766; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00264.html?wapkw=2019-11129
CVE: CVE-2019-5245
Published: 2019-06-13
Description: HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing that could execute arbitrary code.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-427
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190612-01-dllhijacking-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190612-01-dllhijacking-en
CVE: CVE-2019-5286
Published: 2019-06-13
Description: There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190605-01-hedex-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190605-01-hedex-en
CVE: CVE-2019-5439
Published: 2019-06-13
Description: A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html
CVE: CVE-2019-12798
Published: 2019-06-13
Description: An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syntax list size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-185
References: http://git.ghostscript.com/?p=mujs.git%3Bh=7f[PII_REDACTED]5f76e3ec7a63392656ff8c030af9; http://www.securityfocus.com/bid/108774; http://git.ghostscript.com/?p=mujs.git%3Bh=7f[PII_REDACTED]5f76e3ec7a63392656ff8c030af9
CVE: CVE-2019-7321
Published: 2019-06-13
Description: Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-908
References: https://bugs.ghostscript.com/show_bug.cgi?id=700560; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=2be83b57e77938fddbb06bdffb11979ad89a9c7d; https://github.com/ereisr00/bagofbugz/tree/master/MuPDF/700560
CVE: CVE-2018-10946
Published: 2019-06-13
Description: An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to arbitrarily read the admin user's password via the admin web UI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://support.polycom.com/PolycomService/home/home.htm; https://support.polycom.com/content/dam/polycom-support/global/documentation/advisory-rp-debut-vulnerabilities.pdf; https://support.polycom.com/PolycomService/home/home.htm
CVE: CVE-2018-10947
Published: 2019-06-13
Description: An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset only after a Debut is rebooted.
CVSS Score: 3.1 (LOW)
CWE: CWE-20
References: https://support.polycom.com/PolycomService/home/home.htm; https://support.polycom.com/content/dam/polycom-support/global/documentation/advisory-rp-debut-vulnerabilities.pdf; https://support.polycom.com/PolycomService/home/home.htm
CVE: CVE-2019-12799
Published: 2019-06-13
Description: In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/rapid7/metasploit-framework/pull/11828; https://github.com/rapid7/metasploit-framework/pull/11828
CVE: CVE-2019-10959
Published: 2019-06-13
Description: BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software Version 2.3.6 and below, Alaris GS, Alaris GH, Alaris CC, Alaris TIVA, The application does not restrict the upload of malicious files during a firmware update.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/108765; https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01; https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/alaris-gateway-workstation-unauthorized-firmware
CVE: CVE-2019-10962
Published: 2019-06-13
Description: BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not prevent an attacker with knowledge of the IP address of the Alaris Gateway Workstation terminal to gain access to the status and configuration information of the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/108763; https://ics-cert.us-cert.gov/advisories/ICSMA-19-164-01; http://www.securityfocus.com/bid/108763
CVE: CVE-2019-12802
Published: 2019-06-13
Description: In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/radare/radare2/issues/14296; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SX4TLTE75VYUGSPYEKMYFPUZMRDIR7O2/
CVE: CVE-2019-12813
Published: 2019-06-13
Description: An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating the fingerprint image exhibit cleartext when the fingerprint scanner device transfers a fingerprint image to the driver. An attacker who sniffs an encrypted fingerprint image can easily decrypt that image using the key and salt.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://github.com/sungjungk/fp-scanner-hacking; https://www.youtube.com/watch?v=Grirez2xeas; https://www.youtube.com/watch?v=wEXJDyEOatM
CVE: CVE-2019-12818
Published: 2019-06-14
Description: An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00048.html