deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19118
Published: 2019-12-02
Description: Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/12/02/1; https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ
CVE: CVE-2019-19245
Published: 2019-12-02
Description: NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://hyp3rlinx.altervista.org; https://packetstormsecurity.com/files/155505/Xinet-Elegant-6-Asset-Library-Web-Interface-6.1.655-SQL-Injection.html; http://hyp3rlinx.altervista.org
CVE: CVE-2019-15628
Published: 2019-12-02
Description: Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124011.aspx; https://safebreach.com/Post/Trend-Micro-Security-16-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-15628; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124011.aspx
CVE: CVE-2019-19502
Published: 2019-12-02
Description: Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2; https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9; https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
CVE: CVE-2019-12388
Published: 2019-12-02
Description: Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12389
Published: 2019-12-02
Description: Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12390
Published: 2019-12-02
Description: Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port tcp/5010.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12391
Published: 2019-12-02
Description: The Anviz Management System for access control has insufficient logging for device events such as door open requests.
CVSS Score: 7.5 (HIGH)
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12392
Published: 2019-12-02
Description: Anviz access control devices allow remote attackers to issue commands without a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12393
Published: 2019-12-02
Description: Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12394
Published: 2019-12-02
Description: Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html
CVE: CVE-2019-12503
Published: 2019-12-02
Description: Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-319
References: http://packetstormsecurity.com/files/155503/Inateck-BCST-60-Barcode-Scanner-Keystroke-Injection.html; http://seclists.org/fulldisclosure/2019/Nov/30; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-027.txt
CVE: CVE-2019-12518
Published: 2019-12-02
Description: Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://packetstormsecurity.com/files/156335/Anviz-CrossChex-Buffer-Overflow.html; https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html; http://packetstormsecurity.com/files/156335/Anviz-CrossChex-Buffer-Overflow.html
CVE: CVE-2019-19014
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root privileges by an attacker with access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19015
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal PostgreSQL database of the appliance. By connecting to the database through the proxy (without password authentication), an attacker is able to fully control the appliance database. Through this, several different paths exist to gain further access, or execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19016
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injection through the results parameter. This could be used by an attacker to extract sensitive information from the appliance database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19017
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this to gain root privileges on the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-798
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19018
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web administration interface, revealing what database the web application is using.
CVSS Score: 2.7 (LOW)
CWE: CWE-552
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19019
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root. The issue stems from the hotfix download mechanism, which downloads a shell script via HTTP, and then executes it as root. This is analogous to CVE-2019-6800 but for a different product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19020
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19021
Published: 2019-12-02
Description: An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with administrator privileges. Anybody can log in with this account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://write-up.github.io/webtitan/; https://www.webtitan.com/resources/product-updates/; https://write-up.github.io/webtitan/
CVE: CVE-2019-19507
Published: 2019-12-02
Description: In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/manvel-khnkoyan/jpv/issues/6; https://www.npmjs.com/package/jpv; https://github.com/manvel-khnkoyan/jpv/issues/6
CVE: CVE-2012-4428
Published: 2019-12-02
Description: openslp: SLPIntersectStringList()' Function has a DoS vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159059.html; http://www.openwall.com/lists/oss-security/2012/09/13/27; http://www.securityfocus.com/bid/55540
CVE: CVE-2012-4480
Published: 2019-12-02
Description: mom creates world-writable pid files in /var/run
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089658.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090188.html; https://access.redhat.com/security/cve/cve-2012-4480
CVE: CVE-2012-4525
Published: 2019-12-02
Description: piwigo has XSS in password.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/10/18/4; http://www.openwall.com/lists/oss-security/2013/02/11/1; http://www.securityfocus.com/bid/55710
CVE: CVE-2012-4526
Published: 2019-12-02
Description: piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/10/18/4; http://www.openwall.com/lists/oss-security/2013/02/11/1; http://www.securityfocus.com/bid/55710
CVE: CVE-2012-4576
Published: 2019-12-02
Description: FreeBSD: Input Validation Flaw allows local users to gain elevated privileges
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0089.html; http://www.securityfocus.com/bid/56654; http://www.securitytracker.com/id?1027809
CVE: CVE-2013-4410
Published: 2019-12-02
Description: ReviewBoard: has an access-control problem in REST API
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119819.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html
CVE: CVE-2014-9356
Published: 2019-12-02
Description: Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded; https://bugzilla.redhat.com/show_bug.cgi?id=1172761; http://www.securityfocus.com/archive/1/archive/1/534215/100/0/threaded
CVE: CVE-2012-5562
Published: 2019-12-02
Description: A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized parties.
CVSS Score: 8.6 (HIGH)
CWE: CWE-319, CWE-319
References: https://access.redhat.com/security/cve/CVE-2012-5562; https://access.redhat.com/security/cve/cve-2012-5562; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5562
CVE: CVE-2019-15689
Published: 2019-12-02
Description: Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-668
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#021219; https://safebreach.com/Post/Kaspersky-Secure-Connection-DLL-Preloading-and-Potential-Abuses-CVE-2019-15689; https://www.symantec.com/security-center/vulnerabilities/writeup/111033
CVE: CVE-2019-19316
Published: 2019-12-02
Description: When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626; https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626
CVE: CVE-2019-19516
Published: 2019-12-02
Description: Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155557/Intelbras-Router-RF1200-1.1.3-Cross-Site-Request-Forgery.html; https://www.exploit-db.com/exploits/47545; http://packetstormsecurity.com/files/155557/Intelbras-Router-RF1200-1.1.3-Cross-Site-Request-Forgery.html
CVE: CVE-2019-3665
Published: 2019-12-03
Description: Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS102991; http://service.mcafee.com/FAQDocument.aspx?&id=TS102991
CVE: CVE-2019-3666
Published: 2019-12-03
Description: API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site.
CVSS Score: 6.5 (MEDIUM)
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS102991; http://service.mcafee.com/FAQDocument.aspx?&id=TS102991
CVE: CVE-2013-2101
Published: 2019-12-03
Description: Katello has multiple XSS issues in various entities
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2013-2101; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2101; https://access.redhat.com/security/cve/cve-2013-2101
CVE: CVE-2013-2103
Published: 2019-12-03
Description: OpenShift cartridge allows remote URL retrieval
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2013-2103; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2103; https://access.redhat.com/security/cve/cve-2013-2103
CVE: CVE-2013-2106
Published: 2019-12-03
Description: webauth before 4.6.1 has authentication credential disclosure
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2013/05/18/6; https://access.redhat.com/security/cve/cve-2013-2106; https://security-tracker.debian.org/tracker/CVE-2013-2106
CVE: CVE-2013-2228
Published: 2019-12-03
Description: SaltStack RSA Key Generation allows remote users to decrypt communications
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: http://www.openwall.com/lists/oss-security/2013/07/01/1; http://www.securityfocus.com/bid/60868; http://www.securitytracker.com/id/1028717
CVE: CVE-2013-4235
Published: 2019-12-03
Description: shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367
References: https://access.redhat.com/security/cve/cve-2013-4235; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2013-4411
Published: 2019-12-03
Description: Review Board: URL processing gives unauthorized users access to review lists
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119819.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html
CVE: CVE-2013-4486
Published: 2019-12-03
Description: Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://access.redhat.com/security/cve/cve-2013-4486; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4486; https://github.com/zanata/zanata-server/wiki/Security-advisories
CVE: CVE-2019-10075
Published: 2019-12-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-4098
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158020.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158020; https://www.ibm.com/support/pages/node/1118181; https://exchange.xforce.ibmcloud.com/vulnerabilities/158020
CVE: CVE-2019-4130
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158280; https://www.ibm.com/support/pages/node/1118487; https://exchange.xforce.ibmcloud.com/vulnerabilities/158280
CVE: CVE-2019-4226
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159243.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159243; https://www.ibm.com/support/pages/node/1118487; https://exchange.xforce.ibmcloud.com/vulnerabilities/159243
CVE: CVE-2019-4465
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163774; https://www.ibm.com/support/pages/node/1118487; https://exchange.xforce.ibmcloud.com/vulnerabilities/163774
CVE: CVE-2019-4467
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163776.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163776; https://www.ibm.com/support/pages/node/1118487; https://exchange.xforce.ibmcloud.com/vulnerabilities/163776
CVE: CVE-2019-4468
Published: 2019-12-03
Description: IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163777.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163777; https://www.ibm.com/support/pages/node/1118487; https://exchange.xforce.ibmcloud.com/vulnerabilities/163777
CVE: CVE-2019-19523
Published: 2019-12-03
Description: In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://www.openwall.com/lists/oss-security/2019/12/03/4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.7
CVE: CVE-2019-19524
Published: 2019-12-03
Description: In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://www.openwall.com/lists/oss-security/2019/12/03/4
CVE: CVE-2019-19525
Published: 2019-12-03
Description: In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html; http://www.openwall.com/lists/oss-security/2019/12/03/4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.6