deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-2336
Published: 2019-11-21
Description: Subsequent use of the CBO listener may result in further memory corruption due to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, SDX55, SM6150, SM7150, SM8150, SXR2130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2339
Published: 2019-11-21
Description: Out of bound access due to lack of check of whiltelist array size while reading the image elf segments. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2018-8879
Published: 2019-11-21
Description: Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters are flag, mac, and cat_id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://pagedout.institute/download/PagedOut_001_beta1.pdf; https://www.asus.com/Networking/RTAC66U/HelpDesk_BIOS; https://pagedout.institute/download/PagedOut_001_beta1.pdf
CVE: CVE-2019-17272
Published: 2019-11-21
Description: All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow an administrative user to escalate their privileges.
CVSS Score: 7.2 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-17650
Published: 2019-11-21
Description: An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://danishcyberdefence.dk/blog/forticlient_mac; https://fortiguard.com/advisory/FG-IR-19-210; https://danishcyberdefence.dk/blog/forticlient_mac
CVE: CVE-2019-5086
Published: 2019-11-21
Description: An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, version 1.0.7. An integer overflow can occur while walking through tiles that could be exploited to corrupt memory and execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190, CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/02/msg00014.html; https://lists.debian.org/debian-lts-announce/2021/03/msg00008.html; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0878
CVE: CVE-2019-5087
Published: 2019-11-21
Description: An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size, that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190, CWE-787
References: https://lists.debian.org/debian-lts-announce/2021/02/msg00014.html; https://lists.debian.org/debian-lts-announce/2021/03/msg00008.html; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0879
CVE: CVE-2019-5509
Published: 2019-11-21
Description: ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited could allow an unauthenticated remote attacker to enable and use a privileged user account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-6693
Published: 2019-11-21
Description: Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://fortiguard.com/advisory/FG-IR-19-007; https://fortiguard.com/advisory/FG-IR-19-007; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693
CVE: CVE-2019-10767
Published: 2019-11-21
Description: An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:** The attacker has to be logged in if the authentication is enabled (by default isn't enabled).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda; https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881; https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda
CVE: CVE-2019-5071
Published: 2019-11-21
Description: An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS1 post parameters, resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0861; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0861
CVE: CVE-2019-5072
Published: 2019-11-21
Description: An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS2 post parameters, resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0861; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0861
CVE: CVE-2019-15511
Published: 2019-11-21
Description: An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is installed. All GOG Galaxy versions before 1.2.60 and all corresponding versions of GOG Galaxy 2.0 Beta are affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy; https://support.gog.com/hc/en-us/articles/[PII_REDACTED]33-GOG-GALAXY-2-0-updates-and-known-issues; https://cqureacademy.com/cqure-labs/cqlabs-cve-2019-15511-broken-access-control-in-gog-galaxy
CVE: CVE-2019-16405
Published: 2019-11-21
Description: Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/155999/Centreon-19.04-Remote-Code-Execution.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html
CVE: CVE-2019-16406
Published: 2019-11-21
Description: Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse Centreon-autodisco executable file that is launched by cron.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html; https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-10
CVE: CVE-2019-16758
Published: 2019-11-21
Description: In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../../ or ..%2F..%2F..%2F to obtain local files on the host operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/155365/Lexmark-Services-Monitor-2.27.4.0.39-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/Nov/17; http://support.lexmark.com/index?page=content&id=TE930&locale=en&userlocale=EN_US
CVE: CVE-2019-18349
Published: 2019-11-21
Description: HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.
CVSS Score: 9.8 (CRITICAL)
References: https://gist.github.com/matt-thibodeau/8bf16bba4c2a13978ed4e5fd08fbe2c2; https://sourceforge.net/p/hotkeyp/code/HEAD/tree/trunk/WhatsNew.txt; https://sourceforge.net/p/hotkeyp/code/HEAD/tree/trunk/source/Commands.cpp
CVE: CVE-2019-18886
Published: 2019-11-21
Description: An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/symfony/symfony/releases/tag/v4.3.8; https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality; https://symfony.com/blog/symfony-4-3-8-released
CVE: CVE-2019-18890
Published: 2019-11-21
Description: A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/RealLinkers/CVE-2019-18890; https://seclists.org/bugtraq/2019/Nov/31; https://security-tracker.debian.org/tracker/CVE-2019-18890
CVE: CVE-2019-19006
Published: 2019-11-21
Description: Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772; https://pastebin.com/2CdsQMKW; https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass
CVE: CVE-2019-19033
Published: 2019-11-21
Description: Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any username and the hardcoded dev password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/155419/Jalios-JCMS-10-Backdoor-Account-Authentication-Bypass.html; https://community.jalios.com/jcms/frt_74021/en/blog-jalios-community; https://github.com/ricardojoserf/CVE-2019-19033
CVE: CVE-2019-19191
Published: 2019-11-21
Description: Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00017.html; https://bugzilla.suse.com/show_bug.cgi?id=1157471; https://issues.shibboleth.net/jira/browse/SSPCPP-874
CVE: CVE-2019-19197
Published: 2019-11-21
Description: IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHOD_NEITHER results in a read primitive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-11-16-kyrol-internet-security-driver-issue.md; https://nafiez.github.io/security/vulnerability/2019/11/16/kyrol-internet-security-driver-issue.html; https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-11-16-kyrol-internet-security-driver-issue.md
CVE: CVE-2013-3311
Published: 2019-11-21
Description: Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (dot dot) in the URL of an HTTP GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/27878; http://www.securityfocus.com/bid/61970; http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera
CVE: CVE-2013-3312
Published: 2019-11-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration, as demonstrated by a request to set_users.cgi.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera; https://www.exploit-db.com/exploits/27878; http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera
CVE: CVE-2013-3313
Published: 2019-11-21
Description: The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.securityfocus.com/bid/61971; http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera; https://www.exploit-db.com/exploits/27878
CVE: CVE-2013-3314
Published: 2019-11-21
Description: The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), timestamp, serial number, p2p port number, and wifi status via a request to get_status.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/27878; http://www.securityfocus.com/bid/61969; http://www.tripwire.com/state-of-security/vulnerability-management/vulnerability-who-is-watching-your-ip-camera
CVE: CVE-2015-2793
Published: 2019-11-21
Description: Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157001.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157023.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157025.html
CVE: CVE-2019-19202
Published: 2019-11-21
Description: In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html; https://code.vtiger.com/vtiger/vtigercrm/issues/1126; http://lists.vtigercrm.com/pipermail/vtigercrm-developers/2019-April/037964.html
CVE: CVE-2019-5636
Published: 2019-11-21
Description: When a Beckhoff TwinCAT Runtime receives a malformed UDP packet, the ADS Discovery Service shuts down. Note that the TwinCAT devices are still performing as normal. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-004.pdf; https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/
CVE: CVE-2019-5637
Published: 2019-11-21
Description: When Beckhoff TwinCAT is configured to use the Profinet driver, a denial of service of the controller could be reached by sending a malformed UDP packet to the device. This issue affects TwinCAT 2 version 2304 (and prior) and TwinCAT 3.1 version 4204.0 (and prior).
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-369
References: https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/; https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-007.pdf; https://blog.rapid7.com/2019/10/08/r7-2019-32-denial-of-service-vulnerabilities-in-beckhoff-twincat-plc-environment-fixed/
CVE: CVE-2019-19203
Published: 2019-11-21
Description: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ManhNDd/CVE-2019-19203; https://github.com/kkos/oniguruma/issues/163; https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2
CVE: CVE-2019-19204
Published: 2019-11-21
Description: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ManhNDd/CVE-2019-19204; https://github.com/kkos/oniguruma/issues/162; https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2
CVE: CVE-2012-1001
Published: 2019-11-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content parameter to includes/ajax.php or (2) body parameter to includes/error.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0121.html; http://chyrp.net/2012/02/02/heres-whats-been-going-on-recently/; http://www.securityfocus.com/bid/52115
CVE: CVE-2014-8356
Published: 2019-11-21
Description: The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html; http://seclists.org/fulldisclosure/2015/Oct/57; https://www.exploit-db.com/exploits/38453/
CVE: CVE-2015-3140
Published: 2019-11-21
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://web.synametrics.com/SynamanVersionHistory.htm; https://web.synametrics.com/SyncrifyVersionHistory.htm; https://web.synametrics.com/SyntailVersionHistory.htm
CVE: CVE-2019-19207
Published: 2019-11-21
Description: rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://twitter.com/sky_xiaoxuan/status/[PII_REDACTED]96303360; https://twitter.com/sky_xiaoxuan/status/[PII_REDACTED]96303360
CVE: CVE-2012-1637
Published: 2019-11-21
Description: Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/04/07/1; https://www.drupal.org/node/1409476; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2012-2078
Published: 2019-11-21
Description: Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/04/07/1; https://www.drupal.org/node/1506562; http://www.openwall.com/lists/oss-security/2012/04/07/1
CVE: CVE-2014-2901
Published: 2019-11-21
Description: wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2014/04/18/2; https://security-tracker.debian.org/tracker/CVE-2014-2901; http://www.openwall.com/lists/oss-security/2014/04/18/2
CVE: CVE-2014-2902
Published: 2019-11-21
Description: wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2014/04/18/2; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646; https://security-tracker.debian.org/tracker/CVE-2014-2902
CVE: CVE-2014-2904
Published: 2019-11-21
Description: wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/04/18/2; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646; https://security-tracker.debian.org/tracker/CVE-2014-2904
CVE: CVE-2014-5254
Published: 2019-11-21
Description: xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2014/08/15/4; http://www.securityfocus.com/bid/69020; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756600
CVE: CVE-2014-5255
Published: 2019-11-21
Description: xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2014/08/15/4; http://www.securityfocus.com/bid/69020; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756600