deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5815
Published: 2019-12-11
Description: Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-843
References: https://bugs.chromium.org/p/chromium/issues/detail?id=930663; https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b; https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html
CVE: CVE-2019-19707
Published: 2019-12-11
Description: On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVSS Score: 7.5 (HIGH)
References: https://www.moxa.com/en/support/support/security-advisory/eds-g508e-g512e-g516e-series-ethernet-switches-vulnerabilities; https://www.moxa.com/en/support/support/security-advisory/eds-g508e-g512e-g516e-series-ethernet-switches-vulnerabilities
CVE: CVE-2019-19708
Published: 2019-12-11
Description: The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I1f99458fd2c4f6b2460dfe7a93b330ddee4400b6; https://phabricator.wikimedia.org/T239209; https://gerrit.wikimedia.org/r/q/I1f99458fd2c4f6b2460dfe7a93b330ddee4400b6
CVE: CVE-2019-19709
Published: 2019-12-11
Description: MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8; https://phabricator.wikimedia.org/T239466; https://seclists.org/bugtraq/2019/Dec/48
CVE: CVE-2019-19719
Published: 2019-12-11
Description: Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.tableau.com/community/security-bulletins/blog/2019/11/19/important-adv-2019-047-open-redirect-on-embeddedauthredirect-page; https://community.tableau.com/community/security-bulletins/blog/2019/11/19/important-adv-2019-047-open-redirect-on-embeddedauthredirect-page
CVE: CVE-2019-19720
Published: 2019-12-11
Description: Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.yabasic.de/whatsnew.html; https://github.com/marcIhm/yabasic/issues/36; http://www.yabasic.de/whatsnew.html
CVE: CVE-2019-3667
Published: 2019-12-11
Description: DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-427
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102996; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102996
CVE: CVE-2013-4158
Published: 2019-12-11
Description: smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113987.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114008.html; http://www.openwall.com/lists/oss-security/2013/07/20/2
CVE: CVE-2019-18935
Published: 2019-12-11
Description: Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html; http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html; https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html
CVE: CVE-2019-18960
Published: 2019-12-11
Description: Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://www.openwall.com/lists/oss-security/2019/12/10/1; http://www.openwall.com/lists/oss-security/2022/09/11/2; https://github.com/firecracker-microvm/firecracker/issues/1462
CVE: CVE-2013-4245
Published: 2019-12-11
Description: Orca has arbitrary code execution due to insecure Python module load
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2013-4245; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4245; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-4245
CVE: CVE-2013-4593
Published: 2019-12-11
Description: RubyGem omniauth-facebook has an access token security vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/11/18/6; https://access.redhat.com/security/cve/cve-2013-4593; https://exchange.xforce.ibmcloud.com/vulnerabilities/89040
CVE: CVE-2013-6495
Published: 2019-12-11
Description: JBossWeb Bayeux has reflected XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2013-6495; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6495; https://access.redhat.com/security/cve/cve-2013-6495
CVE: CVE-2013-7370
Published: 2019-12-11
Description: node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/04/21/2; http://www.openwall.com/lists/oss-security/2014/05/13/1; https://access.redhat.com/security/cve/cve-2013-7370
CVE: CVE-2013-7371
Published: 2019-12-11
Description: node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/04/21/2; http://www.openwall.com/lists/oss-security/2014/05/13/1; https://access.redhat.com/security/cve/cve-2013-7371
CVE: CVE-2014-0026
Published: 2019-12-11
Description: katello-headpin is vulnerable to CSRF in REST API
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/security/cve/cve-2014-0026; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0026; https://access.redhat.com/security/cve/cve-2014-0026
CVE: CVE-2014-0091
Published: 2019-12-11
Description: Foreman has improper input validation which could lead to partial Denial of Service
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2014-0091; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0091; https://security-tracker.debian.org/tracker/CVE-2014-0091
CVE: CVE-2019-14899
Published: 2019-12-11
Description: A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.
CVSS Score: 7.4 (HIGH)
CWE: CWE-300
References: http://seclists.org/fulldisclosure/2020/Dec/32; http://seclists.org/fulldisclosure/2020/Jul/23; http://seclists.org/fulldisclosure/2020/Jul/24
CVE: CVE-2019-15007
Published: 2019-12-11
Description: The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8439; https://jira.atlassian.com/browse/FE-7250; https://jira.atlassian.com/browse/CRUC-8439
CVE: CVE-2019-15008
Published: 2019-12-11
Description: The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8441; https://jira.atlassian.com/browse/FE-7251; https://jira.atlassian.com/browse/CRUC-8441
CVE: CVE-2019-15009
Published: 2019-12-11
Description: The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/CRUC-8443; https://jira.atlassian.com/browse/FE-7252; https://jira.atlassian.com/browse/CRUC-8443
CVE: CVE-2019-4665
Published: 2019-12-11
Description: IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171247.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171247; https://www.ibm.com/support/pages/node/1118937; https://exchange.xforce.ibmcloud.com/vulnerabilities/171247
CVE: CVE-2019-4715
Published: 2019-12-11
Description: IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172093.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172093; https://www.ibm.com/support/pages/node/1118913; https://exchange.xforce.ibmcloud.com/vulnerabilities/172093
CVE: CVE-2014-0163
Published: 2019-12-11
Description: Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://access.redhat.com/security/cve/cve-2014-0163; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0163; https://access.redhat.com/security/cve/cve-2014-0163
CVE: CVE-2019-10772
Published: 2019-12-11
Description: It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snyk.io/vuln/SNYK-PHP-ENSHRINEDSVGSANITIZE-536969; https://snyk.io/vuln/SNYK-PHP-ENSHRINEDSVGSANITIZE-536969
CVE: CVE-2019-18377
Published: 2019-12-11
Description: Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.2 (HIGH)
References: https://support.symantec.com/us/en/article.SYMSA1501.html; https://support.symantec.com/us/en/article.SYMSA1501.html
CVE: CVE-2019-18378
Published: 2019-12-11
Description: Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.symantec.com/us/en/article.SYMSA1501.html; https://support.symantec.com/us/en/article.SYMSA1501.html
CVE: CVE-2019-18379
Published: 2019-12-11
Description: Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attacker send crafted requests from the backend server of a vulnerable web application or access services available through the loopback interface.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://support.symantec.com/us/en/article.SYMSA1501.html; https://support.symantec.com/us/en/article.SYMSA1501.html
CVE: CVE-2013-4968
Published: 2019-12-11
Description: Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://puppetlabs.com/security/cve/cve-2013-4968; http://puppetlabs.com/security/cve/cve-2013-4968
CVE: CVE-2019-14317
Published: 2019-12-11
Description: wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private key from several hundred DSA signatures via a lattice attack. The issue occurs because dsa.c fixes two bits of the generated nonces.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-331
References: https://www.wolfssl.com/docs/security-vulnerabilities/; https://www.wolfssl.com/docs/security-vulnerabilities/
CVE: CVE-2019-19577
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of pagetables (the pagetable height) in the IOMMU according to the guest's address space size. The code to select and update the height had several bugs. Notably, the update was done without taking a lock which is necessary for safe operation. A malicious guest administrator can cause Xen to access data structures while they are being modified, causing Xen to crash. Privilege escalation is thought to be very difficult but cannot be ruled out. Additionally, there is a potential memory leak of 4kb per guest boot, under memory pressure. Only Xen on AMD CPUs is vulnerable. Xen running on Intel CPUs is not vulnerable. ARM systems are not vulnerable. Only systems where guests are given direct access to physical devices are vulnerable. Systems which do not use PCI pass-through are not vulnerable. Only HVM guests can exploit the vulnerability. PV and PVH guests cannot. All versions of Xen with IOMMU support are vulnerable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-401, CWE-662
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19578
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because of an incorrect fix for CVE-2017-15595. "Linear pagetables" is a technique which involves either pointing a pagetable at itself, or to another pagetable of the same or higher level. Xen has limited support for linear pagetables: A page may either point to itself, or point to another pagetable of the same level (i.e., L2 to L2, L3 to L3, and so on). XSA-240 introduced an additional restriction that limited the "depth" of such chains by allowing pages to either *point to* other pages of the same level, or *be pointed to* by other pages of the same level, but not both. To implement this, we keep track of the number of outstanding times a page points to or is pointed to another page table, to prevent both from happening at the same time. Unfortunately, the original commit introducing this reset this count when resuming validation of a partially-validated pagetable, incorrectly dropping some "linear_pt_entry" counts. If an attacker could engineer such a situation to occur, they might be able to make loops or other arbitrary chains of linear pagetables, as described in XSA-240. A malicious or buggy PV guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be excluded. All versions of Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Only systems which have enabled linear pagetables are vulnerable. Systems which have disabled linear pagetables, either by selecting CONFIG_PV_LINEAR_PT=n when building the hypervisor, or adding pv-linear-pt=false on the command-line, are not vulnerable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19580
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported versions of Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Note that these attacks require very precise timing, which may be difficult to exploit in practice.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19581
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. 32-bit Arm systems are vulnerable. 64-bit Arm systems are not vulnerable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19582
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19583
Published: 2019-12-11
Description: An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. All versions of Xen are affected. Only systems supporting VMX hardware virtual extensions (Intel, Cyrix, or Zhaoxin CPUs) are affected. Arm and AMD systems are unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
CVE: CVE-2019-19649
Published: 2019-12-11
Description: Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventServlet.java doGet function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitlab.com/eLeN3Re/CVE-2019-19649; https://www.manageengine.com/products/applications_manager/release-notes.html; https://gitlab.com/eLeN3Re/CVE-2019-19649
CVE: CVE-2019-19650
Published: 2019-12-11
Description: Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java process function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gitlab.com/eLeN3Re/CVE-2019-19650; https://www.manageengine.com/products/applications_manager/release-notes.html; https://gitlab.com/eLeN3Re/CVE-2019-19650
CVE: CVE-2019-19725
Published: 2019-12-11
Description: sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://github.com/sysstat/sysstat/issues/242; https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html; https://security.gentoo.org/glsa/202007-22