deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18455
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18456
Published: 2019-11-26
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/; https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/
CVE: CVE-2019-18580
Published: 2019-11-26
Description: Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.dell.com/support/security/en-us/details/538977/DSA-2019-176-Dell-EMC-Storage-Monitoring-and-Reporting-SMR-Java-RMI-Deserialization-of-Untruste; https://www.dell.com/support/security/en-us/details/538977/DSA-2019-176-Dell-EMC-Storage-Monitoring-and-Reporting-SMR-Java-RMI-Deserialization-of-Untruste
CVE: CVE-2019-18676
Published: 2019-11-26
Description: An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.squid-cache.org/Advisories/SQUID-2019_8.txt; http://www.squid-cache.org/Versions/v4/changesets/squid-4-fbbdf75efd7a5cc244b4886a9d42ea458c5a3a73.patch; https://bugzilla.suse.com/show_bug.cgi?id=1156329
CVE: CVE-2019-18677
Published: 2019-11-26
Description: An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: http://www.squid-cache.org/Advisories/SQUID-2019_9.txt; http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patch; http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patch
CVE: CVE-2019-18678
Published: 2019-11-26
Description: An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: http://www.squid-cache.org/Advisories/SQUID-2019_10.txt; http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch; https://bugzilla.suse.com/show_bug.cgi?id=1156323
CVE: CVE-2019-18679
Published: 2019-11-26
Description: An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.squid-cache.org/Advisories/SQUID-2019_11.txt; http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patch; https://bugzilla.suse.com/show_bug.cgi?id=1156324
CVE: CVE-2019-16195
Published: 2019-11-26
Description: Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/pull/7876; https://github.com/centreon/centreon/pull/7877; https://github.com/centreon/centreon/releases/tag/18.10.8
CVE: CVE-2019-16201
Published: 2019-11-26
Description: WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html; https://hackerone.com/reports/661722; https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
CVE: CVE-2019-16254
Published: 2019-11-26
Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html; https://hackerone.com/reports/331984; https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
CVE: CVE-2019-16255
Published: 2019-11-26
Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html; https://hackerone.com/reports/327512; https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
CVE: CVE-2019-16386
Published: 2019-11-26
Description: PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://blog.cybercastrum.com/2019/11/25/cve-2019-16386/; https://blog.cybercastrum.com/2019/11/25/cve-2019-16386/
CVE: CVE-2019-16387
Published: 2019-11-26
Description: PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.) NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVSS Score: 8.1 (HIGH)
CWE: CWE-668
References: https://blog.cybercastrum.com/2019/11/25/cve-2019-16387/; https://blog.cybercastrum.com/2019/11/25/cve-2019-16387/
CVE: CVE-2019-16388
Published: 2019-11-26
Description: PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnerability was discovered using an administrator account and they are normal administrator functions. Therefore, the claim that the CVE was done with a low privilege account is incorrect
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://blog.cybercastrum.com/2019/11/25/cve-2019-16388/; https://blog.cybercastrum.com/2019/11/25/cve-2019-16388/
CVE: CVE-2019-17392
Published: 2019-11-26
Description: Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019; https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-November-2019
CVE: CVE-2019-17590
Published: 2019-11-26
Description: The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and dispersing it to a victim via social engineering, enticing them to click the link. Once the user/victim clicks the "try again" button, the attacker can take over the account and perform unintended actions on the victim's behalf. NOTE: A third-party maintainer has stated that this CVE is a false report. They state that the csrf_callback function is actually a callback function to the callers own handler for output. The function called can be changed via configuration to a custom callback to handle failed validation differently. They also stated that there is no way for an attacker to change tokens to make them valid from the client side. The only thing an attack can do is to pull the token out of the javascript, but that will always be possible and has nothing to do with the callback
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://pastebin.com/01tDgq7u; https://pastebin.com/01tDgq7u
CVE: CVE-2011-1933
Published: 2019-11-26
Description: SQL injection vulnerability in Jifty::DBI before 0.68.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.jifty.org/pipermail/jifty-devel/2011-April/002426.html; https://access.redhat.com/security/cve/cve-2011-1933; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622919
CVE: CVE-2011-1934
Published: 2019-11-26
Description: lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/cve-2011-1934; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615103; https://seclists.org/oss-sec/2011/q2/464
CVE: CVE-2011-1939
Published: 2019-11-26
Description: SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://security.gentoo.org/glsa/glsa-201408-01.xml; http://www.securityfocus.com/bid/47919; https://access.redhat.com/security/cve/cve-2011-1939
CVE: CVE-2015-5155
Published: 2019-11-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-3609. Reason: This candidate is a reservation duplicate of CVE-2010-3609. Notes: All CVE users should reference CVE-2010-3609 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2011-4310
Published: 2019-11-26
Description: The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/; https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/
CVE: CVE-2019-10195
Published: 2019-11-27
Description: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-532, CWE-532
References: https://access.redhat.com/errata/RHBA-2019:4268; https://access.redhat.com/errata/RHSA-2020:0378; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10195
CVE: CVE-2019-14867
Published: 2019-11-27
Description: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-400, CWE-94, CWE-400
References: https://access.redhat.com/errata/RHBA-2019:4268; https://access.redhat.com/errata/RHSA-2020:0378; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
CVE: CVE-2019-14896
Published: 2019-11-27
Description: A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://packetstormsecurity.com/files/155879/Kernel-Live-Patch-Security-Notice-LSN-0061-1.html; http://packetstormsecurity.com/files/156185/Kernel-Live-Patch-Security-Notice-LSN-0062-1.html
CVE: CVE-2019-10216
Published: 2019-11-27
Description: In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
CVSS Score: 7.8 (HIGH)
CWE: CWE-648
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5b85ddd19; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10216; https://security.gentoo.org/glsa/202004-03
CVE: CVE-2019-13934
Published: 2019-11-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/; https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/
CVE: CVE-2019-13935
Published: 2019-11-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/; https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/
CVE: CVE-2019-13936
Published: 2019-11-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a persistent XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/; https://xavibel.com/2019/11/25/siemens-polarion-multiple-web-vulnerabilities/
CVE: CVE-2019-14812
Published: 2019-11-27
Description: A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-648, CWE-732
References: http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=885444fcbe10dc42787ecb76686c8ee4dd33bf33; https://access.redhat.com/security/cve/cve-2019-14812; https://bugs.ghostscript.com/show_bug.cgi?id=701444
CVE: CVE-2019-15298
Published: 2019-11-27
Description: A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. This allows one to inject Linux commands directly.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html; https://github.com/centreon/centreon/pull/8023; https://www.certilience.fr/2019/08/CVE-2019-15298-vulnerabilit%C3%A9-centreon-command-injection
CVE: CVE-2019-15300
Published: 2019-11-27
Description: A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html; https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html
CVE: CVE-2019-19308
Published: 2019-11-27
Description: In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117; https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17; https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117
CVE: CVE-2016-4980
Published: 2019-11-27
Description: A password generation weakness exists in xquest through 2016-06-13.
CVSS Score: 2.5 (LOW)
CWE: CWE-330
References: https://access.redhat.com/security/cve/cve-2016-4980; https://bugzilla.redhat.com/show_bug.cgi?id=1346016; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4980
CVE: CVE-2017-12945
Published: 2019-11-27
Description: Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary commands as root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155494/Mersive-Solstice-2.8.0-Remote-Code-Execution.html; https://documentation.mersive.com/content/pages/release-notes.htm; https://github.com/aress31/cve-2017-12945
CVE: CVE-2019-10220
Published: 2019-11-27
Description: Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10220; https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html; https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
CVE: CVE-2019-18184
Published: 2019-11-27
Description: Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.crestron.com/en-US/Products/Video/DigitalMedia-Modular-Matrix/Output-Cards-Blades/DMC-STRO; https://www.quantumleap.it/crestron-dmc-stro-remote-root-rce/; https://www.quantumleap.it/news/advisory/
CVE: CVE-2019-19327
Published: 2019-11-27
Description: ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d; https://gerrit.wikimedia.org/r/#/c/553311/; https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html
CVE: CVE-2019-19328
Published: 2019-11-27
Description: ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d; https://gerrit.wikimedia.org/r/#/c/553311/; https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html
CVE: CVE-2019-19329
Published: 2019-11-27
Description: In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/g/wikidata/query/gui/+/d9f964b88c01748e278ca8c4b8929a8ef0ef0267; https://gerrit.wikimedia.org/r/#/c/wikidata/query/gui/+/549457/; https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001492.html
CVE: CVE-2019-19330
Published: 2019-11-27
Description: The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e; https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878; https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d[PII_REDACTED]
CVE: CVE-2011-2177
Published: 2019-11-27
Description: OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools.
CVSS Score: 7.8 (HIGH)
References: https://access.redhat.com/security/cve/cve-2011-2177; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2177; https://twitter.com/instasegv/status/[PII_REDACTED]4032128