deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11758
Published: 2020-01-08
Description: Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1536227; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2019-25/
CVE: CVE-2019-11759
Published: 2020-01-08
Description: An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1577953; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2019-11760
Published: 2020-01-08
Description: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1577719; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2019-11761
Published: 2020-01-08
Description: By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-362, CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1561502; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2019-11762
Published: 2020-01-08
Description: If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1582857; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2019-11763
Published: 2020-01-08
Description: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1584216; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6583
Published: 2020-01-08
Description: BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack; https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack
CVE: CVE-2019-11764
Published: 2020-01-08
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599; https://security.gentoo.org/glsa/202003-10; https://usn.ubuntu.com/4335-1/
CVE: CVE-2019-11765
Published: 2020-01-08
Description: A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. This vulnerability affects Firefox < 70.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1562582; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1562582
CVE: CVE-2019-17000
Published: 2020-01-08
Description: An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1441468; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1441468
CVE: CVE-2020-6609
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issue-544834443
CVE: CVE-2020-6610
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447120
CVE: CVE-2020-6611
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447190
CVE: CVE-2020-6612
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy_compressed_bytes in decode_r2007.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447169
CVE: CVE-2020-6613
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447025
CVE: CVE-2020-6614
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr_read in decode.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447068
CVE: CVE-2020-6615
Published: 2020-01-08
Description: GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00052.html; https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447223
CVE: CVE-2019-17001
Published: 2020-01-08
Description: A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.*. This vulnerability affects Firefox < 70.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1587976; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1587976
CVE: CVE-2019-17002
Published: 2020-01-08
Description: If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. This vulnerability affects Firefox < 70.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1561056; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1561056
CVE: CVE-2019-17005
Published: 2020-01-08
Description: The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://access.redhat.com/errata/RHSA-2020:0292
CVE: CVE-2019-17008
Published: 2020-01-08
Description: When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://access.redhat.com/errata/RHSA-2020:0292
CVE: CVE-2019-17009
Published: 2020-01-08
Description: When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 7.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1510494
CVE: CVE-2019-17010
Published: 2020-01-08
Description: Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://access.redhat.com/errata/RHSA-2020:0292
CVE: CVE-2019-17011
Published: 2020-01-08
Description: Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://access.redhat.com/errata/RHSA-2020:0292
CVE: CVE-2019-17012
Published: 2020-01-08
Description: Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html; https://access.redhat.com/errata/RHSA-2020:0292
CVE: CVE-2019-17013
Published: 2020-01-08
Description: Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 71.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181; https://www.mozilla.org/security/advisories/mfsa2019-36/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181
CVE: CVE-2019-17014
Published: 2020-01-08
Description: If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vulnerability affects Firefox < 71.
CVSS Score: 7.4 (HIGH)
CWE: CWE-863
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1322864; https://www.mozilla.org/security/advisories/mfsa2019-36/; https://bugzilla.mozilla.org/show_bug.cgi?id=1322864
CVE: CVE-2019-17015
Published: 2020-01-08
Description: During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17016
Published: 2020-01-08
Description: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17017
Published: 2020-01-08
Description: Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17018
Published: 2020-01-08
Description: When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This vulnerability affects Firefox < 72.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1549394; https://www.mozilla.org/security/advisories/mfsa2020-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1549394
CVE: CVE-2019-17019
Published: 2020-01-08
Description: When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 72.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1568003; https://www.mozilla.org/security/advisories/mfsa2020-01/; https://bugzilla.mozilla.org/show_bug.cgi?id=1568003
CVE: CVE-2019-17020
Published: 2020-01-08
Description: If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1597645; https://usn.ubuntu.com/4234-1/; https://www.mozilla.org/security/advisories/mfsa2020-01/
CVE: CVE-2019-17021
Published: 2020-01-08
Description: During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17022
Published: 2020-01-08
Description: When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17023
Published: 2020-01-08
Description: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1590001; https://usn.ubuntu.com/4234-1/; https://usn.ubuntu.com/4397-1/
CVE: CVE-2019-17024
Published: 2020-01-08
Description: Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html; http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
CVE: CVE-2019-17025
Published: 2020-01-08
Description: Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1328295%2C1328300%2C1590447%2C1590965%2C1595692%2C1597321%2C1597481; https://usn.ubuntu.com/4234-1/; https://www.mozilla.org/security/advisories/mfsa2020-01/
CVE: CVE-2019-9812
Published: 2020-01-08
Description: Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69.
CVSS Score: 9.3 (CRITICAL)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1538008; https://bugzilla.mozilla.org/show_bug.cgi?id=1538015; https://www.mozilla.org/security/advisories/mfsa2019-25/
CVE: CVE-2011-5018
Published: 2020-01-08
Description: Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.cloudscan.me/2011/12/cve-2011-5018-koala-framework-xss.html; https://github.com/koala-framework/koala-framework/commit/59f81ea6bd8ef96c04a706a3ca453cd656284faa; https://groups.google.com/forum/#%21topic/koala-framework-dev/wgHDD7N7qhk
CVE: CVE-2011-5247
Published: 2020-01-08
Description: Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.securityfocus.com/archive/1/525003; https://www.securityfocus.com/archive/1/525003
CVE: CVE-2011-5250
Published: 2020-01-08
Description: Snare for Linux before 1.7.0 has CSRF in the web interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/80613; https://www.securityfocus.com/archive/1/525002; https://exchange.xforce.ibmcloud.com/vulnerabilities/80613
CVE: CVE-2011-5266
Published: 2020-01-08
Description: Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2011/May/163; http://seclists.org/fulldisclosure/2011/May/163
CVE: CVE-2020-6617
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.
CVSS Score: 8.8 (HIGH)
CWE: CWE-617
References: https://github.com/nothings/stb/issues/864; https://github.com/nothings/stb/issues/864
CVE: CVE-2020-6618
Published: 2020-01-08
Description: stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/nothings/stb/issues/866; https://github.com/nothings/stb/issues/866