deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18802
Published: 2019-12-13
Description: An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.html; https://blog.envoyproxy.io; https://github.com/envoyproxy/envoy/commits/master
CVE: CVE-2019-18838
Published: 2019-12-13
Description: An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://blog.envoyproxy.io; https://github.com/envoyproxy/envoy/commits/master; https://github.com/envoyproxy/envoy/security/advisories/GHSA-f2rv-4w6x-rwhc
CVE: CVE-2019-19501
Published: 2019-12-13
Description: VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe.
CVSS Score: 7.8 (HIGH)
References: https://www.veracrypt.fr/code/VeraCrypt/commit/?id=07bb27e3b94ee26128d5c7f800cdcf3232ff281a; https://www.veracrypt.fr/en/Release%20Notes.html; https://www.veracrypt.fr/code/VeraCrypt/commit/?id=07bb27e3b94ee26128d5c7f800cdcf3232ff281a
CVE: CVE-2014-1867
Published: 2019-12-13
Description: suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2014/02/10/1; http://www.securityfocus.com/bid/65212; https://exchange.xforce.ibmcloud.com/vulnerabilities/91315
CVE: CVE-2014-2387
Published: 2019-12-13
Description: Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2014/03/13/5; http://www.openwall.com/lists/oss-security/2014/03/14/2; http://www.securityfocus.com/bid/66214
CVE: CVE-2014-3495
Published: 2019-12-13
Description: duplicity 0.6.24 has improper verification of SSL certificates
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://access.redhat.com/security/cve/cve-2014-3495; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3495; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-3495
CVE: CVE-2019-17599
Published: 2019-12-13
Description: The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/QuizandSurveyMaster/quiz_master_next/issues/795; https://github.com/QuizandSurveyMaster/quiz_master_next/pull/796; https://wordpress.org/plugins/quiz-master-next/#developers
CVE: CVE-2019-19397
Published: 2019-12-13
Description: There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit the vulnerability to cause information leaks.
CVSS Score: 7.5 (HIGH)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-vrp-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-vrp-en
CVE: CVE-2019-5248
Published: 2019-12-13
Description: CloudEngine 12800 has a DoS vulnerability. An attacker of a neighboring device sends a large number of specific packets. As a result, a memory leak occurs after the device uses the specific packet. As a result, the attacker can exploit this vulnerability to cause DoS attacks on the target device.
CVSS Score: 7.4 (HIGH)
CWE: CWE-401
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-03-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-03-dos-en
CVE: CVE-2019-5250
Published: 2019-12-13
Description: Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict certain operation of certain privilege, the attacker could trick the user into installing a malicious application before the user turns on student mode function. Successful exploit could allow the attacker to bypass the limit of student mode function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-smartphone-en
CVE: CVE-2019-5251
Published: 2019-12-13
Description: There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An attacker could trick the user into installing, backing up and restoring a malicious application. Successful exploit could cause information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-03-smartphone-en
CVE: CVE-2019-5290
Published: 2019-12-13
Description: Huawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions perform specific operations on affected devices. Because the pointer in the program is not processed properly, the vulnerability can be exploited to cause the device to be abnormal.
CVSS Score: 6.5 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-02-dos-en
CVE: CVE-2019-5291
Published: 2019-12-13
Description: Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packets, and send the modified packets to the peer device. Due to insufficient verification of some fields in the packets, an attacker may exploit the vulnerability to cause the target device to be abnormal.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-345
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en
CVE: CVE-2019-14344
Published: 2019-12-13
Description: TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tematres/TemaTres-Vocabulary-Server/commits/master; https://medium.com/%40Pablo0xSantiago/cve-2019-14344-tematres-3-0-cross-site-scripting-reflected-xss-3826a23c7fff; https://github.com/tematres/TemaTres-Vocabulary-Server/commits/master
CVE: CVE-2019-19785
Published: 2019-12-13
Description: ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
CVE: CVE-2019-19786
Published: 2019-12-13
Description: ATasm 1.06 has a stack-based buffer overflow in the parse_expr() function in setparse.c via a crafted .m65 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
CVE: CVE-2019-19787
Published: 2019-12-13
Description: ATasm 1.06 has a stack-based buffer overflow in the get_signed_expression() function in setparse.c via a crafted .m65 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
CVE: CVE-2019-4426
Published: 2019-12-13
Description: The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162772.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162772; https://www.ibm.com/support/pages/node/1116087; https://www.ibm.com/support/pages/node/1135552
CVE: CVE-2019-19722
Published: 2019-12-13
Description: In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer Dereference. The email must use a group address as either the sender or the recipient.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2019/12/13/3; https://dovecot.org/list/dovecot-news/2019-December/000428.html; https://dovecot.org/pipermail/dovecot-news/2019-December/000428.html
CVE: CVE-2019-17123
Published: 2019-12-13
Description: The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. (Also, the message parameter can have initial HTML comment characters.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://www.egain.com/products/email-management-software/; https://medium.com/maverislabs/cve-2019-17123-cbc946c99f8; http://www.egain.com/products/email-management-software/
CVE: CVE-2019-19774
Published: 2019-12-13
Description: An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint, it is possible to bypass the security restrictions that prevent even administrative users from viewing credential data stored in the database, and recover the MD5 hashes of the accounts used to authenticate the ManageEngine platform to the managed machines on the network (most often administrative accounts). Specifically, this bypasses these restrictions: a query cannot mention password, and a query result cannot have a password column.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/156485/ManageEngine-EventLog-Analyzer-10.0-Information-Disclosure.html; https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39; https://www.manageengine.com/products/eventlog/features-new.html#release
CVE: CVE-2019-19790
Published: 2019-12-13
Description: Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview; https://www.telerik.com/forums/-620f6977edef; https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler
CVE: CVE-2019-19793
Published: 2019-12-13
Description: In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-367
References: https://danishcyberdefence.dk/blog/appgate_part1; https://www.cyxtera.com/pdfs/appgate-sa-2019-07-0001.pdf; https://danishcyberdefence.dk/blog/appgate_part1
CVE: CVE-2019-16730
Published: 2019-12-13
Description: processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://www.securityevaluators.com/research/; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16731
Published: 2019-12-13
Description: The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16732
Published: 2019-12-13
Description: Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-347
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16733
Published: 2019-12-13
Description: processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16734
Published: 2019-12-13
Description: Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16735
Published: 2019-12-13
Description: A stack-based buffer overflow in processCommandUploadLog in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to cause denial of service or run arbitrary code as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16736
Published: 2019-12-13
Description: A stack-based buffer overflow in processCommandUploadSnapshot in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to cause denial of service or run arbitrary code as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-16737
Published: 2019-12-13
Description: The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-17364
Published: 2019-12-13
Description: The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3; https://blog.securityevaluators.com/remotely-exploiting-iot-pet-feeders-21013562aea3
CVE: CVE-2019-19794
Published: 2019-12-13
Description: The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-338
References: https://github.com/coredns/coredns/issues/3519; https://github.com/coredns/coredns/issues/3547; https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
CVE: CVE-2019-19795
Published: 2019-12-13
Description: samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/michaelforney/samurai/issues/29; https://github.com/michaelforney/samurai/issues/29
CVE: CVE-2019-19796
Published: 2019-12-13
Description: Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/marcIhm/yabasic/issues/37; https://github.com/marcIhm/yabasic/issues/37
CVE: CVE-2019-5253
Published: 2019-12-13
Description: E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication when doing certain operations, successful exploit could allow an attacker to cause the device to reboot after launch a man in the middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-04-dos-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-04-dos-en
CVE: CVE-2019-5260
Published: 2019-12-13
Description: Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing the messages, an attacker may send specially crafted TD-SCDMA messages from a rogue base station to the affected devices to exploit this vulnerability. Successful exploit may cause an infinite loop and the device to reboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-mobile-en
CVE: CVE-2019-5278
Published: 2019-12-13
Description: There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attackers who gain the specific permission can use this vulnerability by sending elaborate SQL statements to the database. Successful exploit of this vulnerability may cause the database to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-gauss100-en
CVE: CVE-2019-5254
Published: 2019-12-13
Description: Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board may send crafted messages from the internal network port or tamper with inter-process message packets to exploit this vulnerability. Due to insufficient validation of the message, successful exploit may cause the affected board to be abnormal.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en
CVE: CVE-2019-5255
Published: 2019-12-13
Description: Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a DoS vulnerability. An attacker may send crafted messages from a FTP client to exploit this vulnerability. Due to insufficient validation of the message, successful exploit may cause the system out-of-bounds read and result in a denial of service condition of the affected service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en
CVE: CVE-2019-5256
Published: 2019-12-13
Description: Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a null pointer dereference vulnerability. The system dereferences a pointer that it expects to be valid, but is NULL. A local attacker could exploit this vulnerability by sending crafted parameters. A successful exploit could cause a denial of service and the process reboot.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en
CVE: CVE-2019-5257
Published: 2019-12-13
Description: Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace) have a resource management vulnerability. An attacker who logs in to the board may send crafted messages from the internal network.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en
CVE: CVE-2019-5258
Published: 2019-12-13
Description: Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a buffer overflow vulnerability. An attacker who logs in to the board may send crafted messages from the internal network port or tamper with inter-process message packets to exploit this vulnerability. Due to insufficient validation of the message, successful exploit may cause the affected board to be abnormal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en