deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-4227
Published: 2019-10-04
Description: IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. IBM X-Force ID: 159352.
CVSS Score: 7.3 (HIGH)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159352; https://www.ibm.com/support/pages/node/886899; https://exchange.xforce.ibmcloud.com/vulnerabilities/159352
CVE: CVE-2019-4514
Published: 2019-10-04
Description: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165136.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/165136; https://www.ibm.com/support/pages/node/302017; https://exchange.xforce.ibmcloud.com/vulnerabilities/165136
CVE: CVE-2019-4564
Published: 2019-10-04
Description: IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166625; https://www.ibm.com/support/pages/node/302001; https://exchange.xforce.ibmcloud.com/vulnerabilities/166625
CVE: CVE-2019-17175
Published: 2019-10-04
Description: joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/joyplus/joyplus-cms/issues/443; https://github.com/joyplus/joyplus-cms/issues/443
CVE: CVE-2019-17177
Published: 2019-10-04
Description: libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html; https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a
CVE: CVE-2019-17178
Published: 2019-10-04
Description: HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html; https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a
CVE: CVE-2019-13315
Published: 2019-10-04
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8656.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-632/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13316
Published: 2019-10-04
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8757.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-633/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13317
Published: 2019-10-04
Description: This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8759.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-634/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13318
Published: 2019-10-04
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of the util.printf Javascript method. The application processes the %p parameter in the format string, allowing heap addresses to be returned to the script. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8544.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-635/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13319
Published: 2019-10-04
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8669.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-636/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13320
Published: 2019-10-04
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8814.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-637/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6774
Published: 2019-10-04
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deleteItemAt method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8295.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-629/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6775
Published: 2019-10-04
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportValues method within a AcroForm. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8491.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-630/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6776
Published: 2019-10-04
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing watermarks within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8801.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-631/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17179
Published: 2019-10-04
Description: 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/lodestone-security/CVEs/blob/master/CVE-2019-17179/README.md; https://github.com/openemr/openemr/pull/2701; https://github.com/lodestone-security/CVEs/blob/master/CVE-2019-17179/README.md
CVE: CVE-2019-6015
Published: 2019-10-04
Description: FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave as open resolvers. If this vulnerability is exploited, FON routers may be leveraged for DNS amplification attacks to some other entities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://jvn.jp/en/vu/JVNVU94678942/index.html; https://fonjapan.zendesk.com/hc/ja/articles/[PII_REDACTED]42; http://jvn.jp/en/vu/JVNVU94678942/index.html
CVE: CVE-2019-11655
Published: 2019-10-04
Description: Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569; https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569
CVE: CVE-2019-11656
Published: 2019-10-04
Description: Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569; https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569
CVE: CVE-2019-17180
Published: 2019-10-04
Description: Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevation of privilege, or unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://amonitoring.ru/article/steam_vuln_3/; https://habr.com/ru/company/pm/blog/469507/; https://hackerone.com/reports/583184
CVE: CVE-2019-17183
Published: 2019-10-04
Description: Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-16865
Published: 2019-10-04
Description: An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2020:0566; https://access.redhat.com/errata/RHSA-2020:0578; https://access.redhat.com/errata/RHSA-2020:0580
CVE: CVE-2019-17188
Published: 2019-10-04
Description: An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs because the code relies on the getimagesize function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/fecshop/yii2_fecshop/issues/77; https://github.com/fecshop/yii2_fecshop/issues/77
CVE: CVE-2019-17184
Published: 2019-10-04
Description: Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://security.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19V_for_AltaLinkB80xx-C80xx.pdf; https://securitydocs.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19V_for_AltaLinkB80xx-C80xx-1.pdf; https://security.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19V_for_AltaLinkB80xx-C80xx.pdf
CVE: CVE-2019-17191
Published: 2019-10-05
Description: The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1943; https://news.ycombinator.com/item?id=21161432; https://twitter.com/moxie/status/[PII_REDACTED]41511168
CVE: CVE-2019-17192
Published: 2019-10-05
Description: The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-670
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1936; https://news.ycombinator.com/item?id=21161432; https://twitter.com/moxie/status/[PII_REDACTED]51710976
CVE: CVE-2019-13145
Published: 2019-10-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-17197
Published: 2019-10-05
Description: OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/openemr/openemr/pull/2692; https://github.com/openemr/openemr/pull/2698/files; https://github.com/openemr/openemr/pull/2692
CVE: CVE-2019-17199
Published: 2019-10-05
Description: www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/WPO-Foundation/webpagetest/pull/1299; https://github.com/WPO-Foundation/webpagetest/pull/1299
CVE: CVE-2019-17203
Published: 2019-10-05
Description: TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/TeamPass/issues/2690; https://github.com/nilsteampassnet/TeamPass/issues/2690
CVE: CVE-2019-17204
Published: 2019-10-05
Description: TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/TeamPass/issues/2689; https://github.com/nilsteampassnet/TeamPass/issues/2689
CVE: CVE-2019-17205
Published: 2019-10-05
Description: TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nilsteampassnet/TeamPass/issues/2688; https://github.com/nilsteampassnet/TeamPass/issues/2688
CVE: CVE-2019-17206
Published: 2019-10-05
Description: Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/frostming/rediswrapper/compare/v0.2.1...v0.3.0; https://github.com/frostming/rediswrapper/pull/1; https://github.com/frostming/rediswrapper/releases/tag/v0.3.0
CVE: CVE-2019-17213
Published: 2019-10-06
Description: The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-webarx-cross-site-scripting-1-3-0/; https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html
CVE: CVE-2019-17214
Published: 2019-10-06
Description: The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html; https://packetstormsecurity.com/files/149573/WordPress-WebARX-Website-Firewall-4.9.8-XSS-Bypass.html
CVE: CVE-2019-17215
Published: 2019-10-06
Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) established. An attacker might be able to bruteforce the password to authenticate on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://vuldb.com/?id.140463; https://vuldb.com/?id.140463
CVE: CVE-2019-17216
Published: 2019-10-06
Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-916
References: https://vuldb.com/?id.134117; https://vuldb.com/?id.134117
CVE: CVE-2019-17217
Published: 2019-10-06
Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://vuldb.com/?id.140464; https://vuldb.com/?id.140464
CVE: CVE-2019-17218
Published: 2019-10-06
Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319
References: https://vuldb.com/?id.134116; https://vuldb.com/?id.134116
CVE: CVE-2019-17219
Published: 2019-10-06
Description: An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication. An adjacent attacker is able to use the network interface without proper access control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://vuldb.com/?id.134115; https://vuldb.com/?id.134115
CVE: CVE-2019-17225
Published: 2019-10-06
Description: Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154746/Subrion-4.2.1-Cross-Site-Scripting.html; https://github.com/intelliants/subrion/issues/845; http://packetstormsecurity.com/files/154746/Subrion-4.2.1-Cross-Site-Scripting.html
CVE: CVE-2019-17226
Published: 2019-10-06
Description: CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12148; http://dev.cmsmadesimple.org/bug/view/12148
CVE: CVE-2019-17240
Published: 2019-10-06
Description: bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://packetstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.html; http://packetstormsecurity.com/files/159664/Bludit-3.9.2-Bruteforce-Mitigation-Bypass.html; https://github.com/bludit/bludit/pull/1090
CVE: CVE-2019-17263
Published: 2019-10-06
Description: In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html; https://github.com/libyal/libfwsi/compare/20181227...20191006; https://github.com/libyal/libfwsi/issues/13