deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-2279
Published: 2019-07-22
Description: Shared memory gets updated with invalid data and may lead to access beyond the allocated memory. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, Snapdragon_High_Med_2016
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin
CVE: CVE-2019-2287
Published: 2019-07-22
Description: Improper validation for inputs received from firmware can lead to an out of bound write issue in video driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin
CVE: CVE-2019-2292
Published: 2019-07-22
Description: Out of bound access can occur due to buffer copy without checking size of input received from WLAN firmware in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9650, MSM8996AU, QCA6574AU, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin
CVE: CVE-2019-4236
Published: 2019-07-22
Description: A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to restore or retrieve the object with incorrect ACL entries. IBM X-Force ID: 159418.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-19
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159418; https://www.ibm.com/support/docview.wss?uid=ibm10884766; https://exchange.xforce.ibmcloud.com/vulnerabilities/159418
CVE: CVE-2019-4267
Published: 2019-07-22
Description: The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. This could allow execution of arbitrary code on the local system or the application to crash. IBM X-Force ID: 160200.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=ibm10884768; https://exchange.xforce.ibmcloud.com/vulnerabilities/160200; http://www.ibm.com/support/docview.wss?uid=ibm10884768
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://drive.google.com/file/d/1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv/view?usp=sharing; https://drive.google.com/file/d/1OkMtrMgjjINsDUQwxpGxjbATB6hiwqyv/view?usp=sharing
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://somerandomshitwbu.blogspot.com/2019/01/stored-xss-in-frog-cms-open-source.html; https://somerandomshitwbu.blogspot.com/2019/01/stored-xss-in-frog-cms-open-source.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docu.ilias.de/goto_docu_pg_116867_35.html; https://github.com/ILIAS-eLearning/ILIAS/commit/b9150b7194f8cfb1178ca3674a0b3c86b7cd92f5; https://github.com/ILIAS-eLearning/ILIAS/commit/f1c2f906410bf35bb6bd45efff57d2e8da3b3825
CVE: CVE-2019-9959
Published: 2019-07-22
Description: The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://www.securityfocus.com/bid/109342; https://access.redhat.com/errata/RHSA-2019:2713; https://gitlab.freedesktop.org/poppler/poppler/blob/master/NEWS
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow. The impact is: remote dos. The component is: slaxlexer.c:601(funtion:slaxGetInput). The attack vector is: ./slaxproc --slax-to-xslt POC0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1649175; https://bugzilla.redhat.com/show_bug.cgi?id=1649175
CVE: CVE-2019-12324
Published: 2019-07-22
Description: A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE: CVE-2019-12325
Published: 2019-07-22
Description: The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker to crash the device (DoS) without authentication or execute code (authenticated as a user) to spawn a remote shell as a root user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Htek_UC902.pdf; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Htek_UC902.pdf
CVE: CVE-2019-13098
Published: 2019-07-22
Description: The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://pastebin.com/a5VhaxYn; https://pastebin.com/raw/rVGbwSw0; https://pastebin.com/a5VhaxYn
CVE: CVE-2019-13099
Published: 2019-07-22
Description: The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user and a user's access token via Logcat.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://pastebin.com/SgVPb7Lb; https://pastebin.com/SgVPb7Lb
CVE: CVE-2019-13100
Published: 2019-07-22
Description: The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out the username/password of a valid user via /data/data/com.estmob.android.sendanywhere/shared_prefs/sendanywhere_device.xml.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://pastebin.com/Gdd0Shgr; https://pastebin.com/Gdd0Shgr
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQOAULR72EYJQ4HS6YGLK2S6YNEXY2ET/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX/; https://support.dcmtk.org/redmine/issues/858
CVE: CVE-2019-12326
Published: 2019-07-22
Description: Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE: CVE-2019-13096
Published: 2019-07-22
Description: TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/<wallet-name>.xml to gain unauthorized access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312
References: https://pastebin.com/raw/08REmV1X; https://pastebin.com/raw/J9B8Lh0j; https://pastebin.com/raw/08REmV1X
CVE: CVE-2019-13097
Published: 2019-07-22
Description: The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. Attackers can manipulate users' score parameters exchanged between client and server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://pastebin.com/WkkGk0tw; https://www.youtube.com/watch?v=u5iEeLZnYVg; https://pastebin.com/WkkGk0tw
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The component is: Main cherokee command. The attack vector is: Overwrite argv[0] to an insane length with execl. The fixed version is: There's no fix yet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-787
References: https://i.imgur.com/PWCCyir.png; https://i.imgur.com/PWCCyir.png
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". The attack vector is: The victim must open a specially crafted pcap file.
CVSS Score: 3.3 (LOW)
CWE: CWE-126, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00065.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19801. Reason: This candidate is a reservation duplicate of CVE-2018-19801. Notes: All CVE users should reference CVE-2018-19801 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19800. Reason: This candidate is a reservation duplicate of CVE-2018-19800. Notes: All CVE users should reference CVE-2018-19800 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-19802. Reason: This candidate is a reservation duplicate of CVE-2018-19802. Notes: All CVE users should reference CVE-2018-19802 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12327
Published: 2019-07-22
Description: Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Akuvox_R50P.pdf
CVE: CVE-2019-12328
Published: 2019-07-22
Description: A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-78
References: https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Atcom_A10W.pdf; https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_Atcom_A10W.pdf
CVE: CVE-2019-3414
Published: 2019-07-22
Description: All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front end does not process the returned result from the interface properly, the malicious script may be executed and the user cookie or other important information may be stolen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010883; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010883
CVE: CVE-2019-12551
Published: 2019-07-22
Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://ereisr00.github.io/; https://github.com/ereisr00/bagofbugz/blob/master/010Editor; https://www.sweetscape.com/010editor/manual/ReleaseNotes.htm
CVE: CVE-2019-12552
Published: 2019-07-22
Description: In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://ereisr00.github.io/; https://github.com/ereisr00/bagofbugz/blob/master/010Editor; https://www.sweetscape.com/010editor/manual/ReleaseNotes.htm
CVE: CVE-2019-14240
Published: 2019-07-23
Description: WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-352
References: http://www.iwantacve.cn/index.php/archives/266/; http://www.iwantacve.cn/index.php/archives/266/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://modx.pro/security/15912#comment-99640; https://modx.today/posts/2018/07/critical-security-vulnerability-in-gallery-1.7.1; https://modx.pro/security/15912#comment-99640
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154263/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/9856; https://www.youtube.com/watch?v=T-sqQDFRRBg
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a reservation duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-10173
Published: 2019-07-23
Description: It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-502
References: http://x-stream.github.io/changes.html#1.4.11; https://access.redhat.com/errata/RHSA-2019:3892; https://access.redhat.com/errata/RHSA-2019:4352
CVE: CVE-2019-14241
Published: 2019-07-23
Description: HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00062.html; http://www.securityfocus.com/bid/109352
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Lz1y/acd1bfd0cc0e0f53b8f781840e7bf368; https://gist.github.com/Lz1y/acd1bfd0cc0e0f53b8f781840e7bf368
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/Lz1y/e82eb9cc776e629b9d1874dc689421eb; https://gist.github.com/Lz1y/e82eb9cc776e629b9d1874dc689421eb
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/Lz1y/7ab529230c43dfc5441ac32dd13e3e5b; https://gist.github.com/Lz1y/7ab529230c43dfc5441ac32dd13e3e5b
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://gist.github.com/Lz1y/cfb2f8179003b91404ad029333508f4c; https://gist.github.com/Lz1y/cfb2f8179003b91404ad029333508f4c
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/Lz1y/31595b060cd6a031896fdf2b3a1273f5; https://gist.github.com/Lz1y/31595b060cd6a031896fdf2b3a1273f5
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/109351; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.youtube.com/watch?v=7sk6agpcA_s
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:121). The attack vector is: The victim must execute crafted javascript code. The fixed version is: 2.4.77.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://jsish.org/fossil/jsi/tktview/5533c4d665b9683eebe4d662493f15eb911d1c8f; https://jsish.org/fossil/jsi/tktview/5533c4d665b9683eebe4d662493f15eb911d1c8f
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://jsish.org/fossil/jsi/tktview/3a069014976f3422d9d96821dc555c8326c02ae3; https://jsish.org/fossil/jsi/tktview/3a069014976f3422d9d96821dc555c8326c02ae3
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jsish.org/fossil/jsi/tktview/870f496bb8a707491df8026e2ff78b33a5cf44c1; https://jsish.org/fossil/jsi/tktview/870f496bb8a707491df8026e2ff78b33a5cf44c1
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: function jsi_DumpFunctions (jsiEval.c:567). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.84.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://jsish.org/fossil/jsi/tktview/a3026a7c06e0f41af461aa0bc2f7a7e886209390; https://jsish.org/fossil/jsi/tktview/a3026a7c06e0f41af461aa0bc2f7a7e886209390