deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1852
Published: 2019-05-03
Description: A vulnerability in the web-based management interface of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-pnr-xss; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-pnr-xss
CVE: CVE-2019-1854
Published: 2019-05-03
Description: A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to bypass security restrictions and access the web interface of a Cisco Unified Communications Manager associated with the affected device. Valid credentials would still be required to access the Cisco Unified Communications Manager interface.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/152963/Cisco-Expressway-Gateway-11.5.1-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/May/28; http://www.securityfocus.com/bid/108154
CVE: CVE-2019-1856
Published: 2019-05-03
Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to the insufficient validation of data supplied by external devices to the web-based management interface of an affected PCA device. An attacker in control of devices integrated with an affected PCA device could exploit this vulnerability by using crafted data in certain fields of the controlled devices. A successful exploit could allow the attacker to execute arbitrary script code in the context of the PCA web-based management interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/108148; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-pca-xss; http://www.securityfocus.com/bid/108148
CVE: CVE-2019-1857
Published: 2019-05-03
Description: A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system by using a web browser and with the privileges of the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/108163; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-hyperflex-csrf; http://www.securityfocus.com/bid/108163
CVE: CVE-2019-1859
Published: 2019-05-03
Description: A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. An attacker could exploit this vulnerability by attempting to connect to the device via SSH. A successful exploit could allow the attacker to access the configuration as an administrative user if the default credentials are not changed. There are no workarounds available; however, if client-side certificate authentication is enabled, disable it and use strong password authentication. Client-side certificate authentication is disabled by default.
CVSS Score: 7.2 (HIGH)
CWE: CWE-285, CWE-295
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv
CVE: CVE-2019-6611
Published: 2019-05-03
Description: When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VPN traffic, the BIG-IP system may execute incorrect logic. The TMM may restart and produce a core file as a result of this condition. The BIG-IP system provisioned with the CGNAT module and configured with a virtual server using a PPTP profile is exposed to this vulnerability.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/108187; https://support.f5.com/csp/article/K47527163; http://www.securityfocus.com/bid/108187
CVE: CVE-2019-6612
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a response from a DNS cache may cause TMM to restart.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/108295; https://support.f5.com/csp/article/K24401914; http://www.securityfocus.com/bid/108295
CVE: CVE-2019-6613
Published: 2019-05-03
Description: On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is used with various profile types and is accessed using SNMPv2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: http://www.securityfocus.com/bid/108183; https://support.f5.com/csp/article/K27400151; http://www.securityfocus.com/bid/108183
CVE: CVE-2018-20580
Published: 2019-05-03
Description: The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/152731/ReadyAPI-2.5.0-2.6.0-Remote-Code-Execution.html; https://github.com/gscamelo/CVE-2018-20580; https://vimeo.com/332912402
CVE: CVE-2018-20824
Published: 2019-05-03
Description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-69238; https://jira.atlassian.com/browse/JRASERVER-69238
CVE: CVE-2019-11036
Published: 2019-05-03
Description: When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-126, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html
CVE: CVE-2019-11037
Published: 2019-05-03
Description: In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00016.html; http://www.securityfocus.com/bid/108292; https://bugs.php.net/bug.php?id=77791
CVE: CVE-2019-3400
Published: 2019-05-03
Description: The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/108168; https://jira.atlassian.com/browse/JRASERVER-69245; http://www.securityfocus.com/bid/108168
CVE: CVE-2019-3805
Published: 2019-05-03
Description: A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-364, CWE-269
References: https://access.redhat.com/errata/RHSA-2019:1106; https://access.redhat.com/errata/RHSA-2019:1107; https://access.redhat.com/errata/RHSA-2019:1108
CVE: CVE-2019-3894
Published: 2019-05-03
Description: It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.
CVSS Score: 8.8 (HIGH)
CWE: CWE-358
References: https://access.redhat.com/errata/RHSA-2019:1106; https://access.redhat.com/errata/RHSA-2019:1107; https://access.redhat.com/errata/RHSA-2019:1108
CVE: CVE-2019-6158
Published: 2019-05-03
Description: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x.
CVSS Score: 8.7 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/108165; https://support.lenovo.com/solutions/LEN-26141; http://www.securityfocus.com/bid/108165
CVE: CVE-2019-6614
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/108297; https://support.f5.com/csp/article/K46524395; http://www.securityfocus.com/bid/108297
CVE: CVE-2019-6615
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems.
CVSS Score: 4.9 (MEDIUM)
References: http://www.securityfocus.com/bid/108189; https://support.f5.com/csp/article/K87659521; http://www.securityfocus.com/bid/108189
CVE: CVE-2019-6616
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical system files on BIG-IP which can result in bypass of whitelist / blacklist restrictions enforced by appliance mode.
CVSS Score: 7.2 (HIGH)
References: http://www.securityfocus.com/bid/108298; https://support.f5.com/csp/article/K82814400; http://www.securityfocus.com/bid/108298
CVE: CVE-2019-6617
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite sensitive low-level files (such as /etc/passwd) using SFTP to modify user permissions, without Advanced Shell access. This is contrary to our definition for the Resource Administrator (RA) role restrictions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/108186; https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2019-6617.txt; https://support.f5.com/csp/article/K38941195
CVE: CVE-2019-6618
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions.
CVSS Score: 4.9 (MEDIUM)
References: https://support.f5.com/csp/article/K07702240; https://support.f5.com/csp/article/K07702240
CVE: CVE-2019-6619
Published: 2019-05-03
Description: On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile with Application Layer Protocol Negotiation (ALPN) enabled and it processes traffic where the ALPN extension size is zero.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/108190; https://support.f5.com/csp/article/K94563344; http://www.securityfocus.com/bid/108190
CVE: CVE-2019-11766
Published: 2019-05-05
Description: dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108172; https://bugs.debian.org/928440; https://roy.marples.name/archives/dhcpcd-discuss/0002428.html
CVE: CVE-2019-11767
Published: 2019-05-05
Description: Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941; https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941
CVE: CVE-2019-10249
Published: 2019-05-06
Description: All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494, CWE-829, CWE-116
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996; https://github.com/eclipse/xtext-xtend/issues/759; https://bugs.eclipse.org/bugs/show_bug.cgi?id=546996
CVE: CVE-2019-3552
Published: 2019-05-06
Description: C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-755
References: http://www.securityfocus.com/bid/108279; https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE: CVE-2019-3558
Published: 2019-05-06
Description: Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-755
References: http://www.securityfocus.com/bid/108274; https://github.com/facebook/fbthrift/commit/c5d6e07588cd03061bc54d451a7fa6e84883d62b; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE: CVE-2019-3559
Published: 2019-05-06
Description: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-755
References: https://github.com/facebook/fbthrift/commit/a56346ceacad28bf470017a6bda1d5518d0bd943; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E; https://www.facebook.com/security/advisories/cve-2019-3559
CVE: CVE-2019-3564
Published: 2019-05-06
Description: Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-755
References: https://github.com/facebook/fbthrift/commit/c461c1bd1a3e130b181aa9c854da3030cd4b5156; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E; https://www.facebook.com/security/advisories/cve-2019-3564
CVE: CVE-2019-3565
Published: 2019-05-06
Description: Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834, CWE-755
References: http://www.securityfocus.com/bid/108280; https://github.com/facebook/fbthrift/commit/01686e15ec77ccb4d49a77d5bce3a01601e54d64; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE: CVE-2019-3797
Published: 2019-05-06
Description: This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
CVSS Score: 3.5 (LOW)
CWE: CWE-89, CWE-200
References: https://pivotal.io/security/cve-2019-3797; https://pivotal.io/security/cve-2019-3797
CVE: CVE-2019-3799
Published: 2019-05-06
Description: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://pivotal.io/security/cve-2019-3799; https://www.oracle.com/security-alerts/cpuapr2022.html; https://pivotal.io/security/cve-2019-3799
CVE: CVE-2019-5430
Published: 2019-05-06
Description: In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://community.ubnt.com/t5/UniFi-Video-Blog/UniFi-Video-3-10-1-Soft-Release/ba-p/2658279; https://hackerone.com/reports/329749; https://community.ubnt.com/t5/UniFi-Video-Blog/UniFi-Video-3-10-1-Soft-Release/ba-p/2658279
CVE: CVE-2019-5431
Published: 2019-05-06
Description: This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-345
References: https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html; https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html
CVE: CVE-2019-5432
Published: 2019-05-06
Description: A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://hackerone.com/reports/541354; https://hackerone.com/reports/541354
CVE: CVE-2019-5433
Published: 2019-05-06
Description: A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://hackerone.com/reports/390663; https://www.revive-adserver.com/security/revive-sa-2019-001/; https://hackerone.com/reports/390663
CVE: CVE-2019-5434
Published: 2019-05-06
Description: An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html; https://hackerone.com/reports/512076; https://hackerone.com/reports/542670
CVE: CVE-2018-17201
Published: 2019-05-06
Description: Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
CVSS Score: 7.5 (HIGH)
References: https://lists.apache.org/thread.html/cd37861963aa6d2694c8947d464c99614d3e1a9db6c1a2a8b7b5840a%40%3Cdev.commons.apache.org%3E; https://lists.apache.org/thread.html/cd37861963aa6d2694c8947d464c99614d3e1a9db6c1a2a8b7b5840a%40%3Cdev.commons.apache.org%3E
CVE: CVE-2018-17202
Published: 2019-05-06
Description: Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://lists.apache.org/thread.html/69204376d12205b0d2d90e6fcbeebb99b894e6db88c8ff565c4e1efa%40%3Cdev.commons.apache.org%3E; https://lists.apache.org/thread.html/69204376d12205b0d2d90e6fcbeebb99b894e6db88c8ff565c4e1efa%40%3Cdev.commons.apache.org%3E