deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5484
Published: 2019-09-13
Description: Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3; https://hackerone.com/reports/473811; https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
CVE: CVE-2019-5485
Published: 2019-09-13
Description: NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/154598/NPMJS-gitlabhook-0.0.17-Remote-Command-Execution.html; https://hackerone.com/reports/685447; http://packetstormsecurity.com/files/154598/NPMJS-gitlabhook-0.0.17-Remote-Command-Execution.html
CVE: CVE-2019-16303
Published: 2019-09-14
Description: A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: https://github.com/jhipster/generator-jhipster/commit/88448b85fd3e8e49df103f[PII_REDACTED]c2c68ea7; https://github.com/jhipster/generator-jhipster/issues/10401; https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-mwp6-j9wf-968c
CVE: CVE-2019-16305
Published: 2019-09-14
Description: In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command execution is achieved, as demonstrated by the MobaXterm://`calc` URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://freetom.github.io/0day/2019/09/14/MobaXterm-command-exec-in-protocol-handler.html; https://freetom.github.io/0day/2019/09/14/MobaXterm-command-exec-in-protocol-handler.html
CVE: CVE-2019-16294
Published: 2019-09-14
Description: SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/154706/Notepad-Code-Execution-Denial-Of-Service.html; https://github.com/bi7s/CVE/tree/master/CVE-2019-16294; https://notepad-plus-plus.org/download/v7.7.html
CVE: CVE-2019-16309
Published: 2019-09-14
Description: FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.iwantacve.cn/index.php/archives/317/; http://www.iwantacve.cn/index.php/archives/317/
CVE: CVE-2019-16310
Published: 2019-09-14
Description: NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.iwantacve.cn/index.php/archives/304/; http://www.iwantacve.cn/index.php/archives/304/
CVE: CVE-2019-16311
Published: 2019-09-14
Description: NIUSHOP V1.11 has CSRF via search&#95;info to index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.iwantacve.cn/index.php/archives/304/; http://www.iwantacve.cn/index.php/archives/304/
CVE: CVE-2019-16312
Published: 2019-09-14
Description: s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.iwantacve.cn/index.php/archives/320/; http://www.iwantacve.cn/index.php/archives/320/
CVE: CVE-2019-16313
Published: 2019-09-14
Description: ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://www.iwantacve.cn/index.php/archives/311/; http://www.iwantacve.cn/index.php/archives/311/
CVE: CVE-2019-16314
Published: 2019-09-14
Description: Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
CVSS Score: 9.8 (CRITICAL)
References: http://www.iwantacve.cn/index.php/archives/324/; http://www.iwantacve.cn/index.php/archives/324/
CVE: CVE-2019-16307
Published: 2019-09-14
Description: A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/izadgot/3efc75f62f9c9567c8f11bad74165425; https://gist.github.com/izadgot/3efc75f62f9c9567c8f11bad74165425
CVE: CVE-2019-16317
Published: 2019-09-14
Description: In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/pimcore/pimcore/commit/6ee5d8536d0802e377594cbe39083e822710aab9; https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-451599; https://github.com/pimcore/pimcore/commit/6ee5d8536d0802e377594cbe39083e822710aab9
CVE: CVE-2019-16318
Published: 2019-09-14
Description: In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/pimcore/pimcore/commit/732f1647cc6e0a29b5b1f5d904b4d726b5e9455f; https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-451598; https://github.com/pimcore/pimcore/commit/732f1647cc6e0a29b5b1f5d904b4d726b5e9455f
CVE: CVE-2019-16319
Published: 2019-09-15
Description: In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a
CVE: CVE-2019-16320
Published: 2019-09-15
Description: Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://misteralfa-hack.blogspot.com/2019/09/cobham-terminales-satelitales-seatel.html; https://misteralfa-hack.blogspot.com/2019/09/cobham-terminales-satelitales-seatel.html
CVE: CVE-2019-16321
Published: 2019-09-15
Description: ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://misteralfa-hack.blogspot.com/2019/09/scadabr-scada-vulnerable-xss.html; https://misteralfa-hack.blogspot.com/2019/09/scadabr-scada-vulnerable-xss.html
CVE: CVE-2019-14540
Published: 2019-09-15
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:3200; https://access.redhat.com/errata/RHSA-2020:0159; https://access.redhat.com/errata/RHSA-2020:0160
CVE: CVE-2019-16332
Published: 2019-09-15
Description: In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/154369/WordPress-API-Bearer-Auth-20181229-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset/2152730; https://wordpress.org/plugins/api-bearer-auth/#developers
CVE: CVE-2019-16333
Published: 2019-09-15
Description: GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1313; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1313
CVE: CVE-2019-16334
Published: 2019-09-15
Description: In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/bludit/bludit/issues/1078; https://github.com/bludit/bludit/issues/1078
CVE: CVE-2019-16335
Published: 2019-09-15
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:3200; https://access.redhat.com/errata/RHSA-2020:0159; https://access.redhat.com/errata/RHSA-2020:0160
CVE: CVE-2016-10956
Published: 2019-09-16
Description: The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://wordpress.org/plugins/mail-masta/#developers; https://wpvulndb.com/vulnerabilities/8609
CVE: CVE-2017-18634
Published: 2019-09-16
Description: The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://blog.sucuri.net/2017/06/unwanted-shorte-st-ads-in-unpatched-newspaper-theme.html; https://blog.sucuri.net/2017/06/unwanted-shorte-st-ads-in-unpatched-newspaper-theme.html
CVE: CVE-2019-13474
Published: 2019-09-16
Description: TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have insufficient access control for the /set_dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/174503/Internet-Radio-auna-IR-160-SE-UIProto-DoS-XSS-Missing-Authentication.html; http://seclists.org/fulldisclosure/2019/Sep/12; http://seclists.org/fulldisclosure/2023/Sep/1
CVE: CVE-2019-16057
Published: 2019-09-16
Description: The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://blog.cystack.net/d-link-dns-320-rce/; https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf; https://blog.cystack.net/d-link-dns-320-rce/
CVE: CVE-2019-16170
Published: 2019-09-16
Description: An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Control.
CVSS Score: 7.1 (HIGH)
References: https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/; https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/
CVE: CVE-2016-10957
Published: 2019-09-16
Description: The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8607; https://www.saotn.org/wordpress-advisory-akal-theme-xss-vulnerability/; https://wpvulndb.com/vulnerabilities/8607
CVE: CVE-2016-10958
Published: 2019-09-16
Description: The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://estatik.net/estatik-released-security-updates/; https://wordpress.org/plugins/estatik/#developers; https://www.pluginvulnerabilities.com/2016/08/01/arbitrary-file-upload-vulnerability-in-estatik/
CVE: CVE-2016-10959
Published: 2019-09-16
Description: The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://wordpress.org/plugins/estatik/#developers; https://www.pluginvulnerabilities.com/2016/08/19/authenticated-arbitrary-file-upload-vulnerability-in-estatik/; https://wordpress.org/plugins/estatik/#developers
CVE: CVE-2016-10960
Published: 2019-09-16
Description: The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://wordpress.org/plugins/wsecure/#developers; https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/; https://wordpress.org/plugins/wsecure/#developers
CVE: CVE-2016-10961
Published: 2019-09-16
Description: The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_colorway_wordpress_theme.html; https://wpvulndb.com/vulnerabilities/8568; https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_colorway_wordpress_theme.html
CVE: CVE-2016-10962
Published: 2019-09-16
Description: The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_icegram_wordpress_plugin.html; https://wordpress.org/plugins/icegram/#developers; https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_icegram_wordpress_plugin.html
CVE: CVE-2016-10963
Published: 2019-09-16
Description: The icegram plugin before 1.9.19 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/icegram/#developers; https://wordpress.org/plugins/icegram/#developers
CVE: CVE-2016-10964
Published: 2019-09-16
Description: The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://rastating.github.io/dwnldr-1-0-stored-xss-disclosure/; https://wordpress.org/plugins/dwnldr/#developers; https://rastating.github.io/dwnldr-1-0-stored-xss-disclosure/
CVE: CVE-2016-10965
Published: 2019-09-16
Description: The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/; https://wordpress.org/plugins/real3d-flipbook-lite/#developers; https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/
CVE: CVE-2016-10966
Published: 2019-09-16
Description: The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/; https://wordpress.org/plugins/real3d-flipbook-lite/#developers; https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/
CVE: CVE-2016-10967
Published: 2019-09-16
Description: The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/; https://wordpress.org/plugins/real3d-flipbook-lite/#developers; https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/
CVE: CVE-2016-10968
Published: 2019-09-16
Description: The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.pritect.net/blog/peepso-1-6-0-logged-user-privilege-escalation; https://wordpress.org/plugins/peepso-core/#developers; http://www.pritect.net/blog/peepso-1-6-0-logged-user-privilege-escalation
CVE: CVE-2016-10969
Published: 2019-09-16
Description: The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SupportFlow/supportflow/commit/c08d376072f093b650c49dcb44124f43ea0177b1; https://wordpress.org/plugins/supportflow/#developers; https://github.com/SupportFlow/supportflow/commit/c08d376072f093b650c49dcb44124f43ea0177b1
CVE: CVE-2016-10970
Published: 2019-09-16
Description: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SupportFlow/supportflow/commit/c507cc863d161f87c28d0682714bf188ffac1a67; https://wordpress.org/plugins/supportflow/#developers; https://github.com/SupportFlow/supportflow/commit/c507cc863d161f87c28d0682714bf188ffac1a67
CVE: CVE-2016-10971
Published: 2019-09-16
Description: The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://www.pritect.net/blog/membersonic-lite-1-2-unauthenticated-login; http://www.pritect.net/blog/membersonic-lite-1-2-unauthenticated-login
CVE: CVE-2018-21015
Published: 2019-09-16
Description: AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. There is "cfg_new->AVCLevelIndication = cfg->AVCLevelIndication;" but cfg could be NULL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1179; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1179
CVE: CVE-2018-21016
Published: 2019-09-16
Description: audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gpac/gpac/issues/1180; https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html; https://github.com/gpac/gpac/issues/1180
CVE: CVE-2018-21017
Published: 2019-09-16
Description: GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/gpac/gpac/commit/d2371b4b204f0a3c0af51ad4e9b491144dd1225c; https://github.com/gpac/gpac/issues/1183; https://github.com/gpac/gpac/commit/d2371b4b204f0a3c0af51ad4e9b491144dd1225c
CVE: CVE-2019-16197
Published: 2019-09-16
Description: In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154481/Dolibarr-ERP-CRM-10.0.1-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/154481/Dolibarr-ERP-CRM-10.0.1-Cross-Site-Scripting.html
CVE: CVE-2019-16264
Published: 2019-09-16
Description: In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://infayer.com/?p=43; https://infayer.com/?p=43
CVE: CVE-2019-16346
Published: 2019-09-16
Description: ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682, CWE-787
References: https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a; https://github.com/miniupnp/ngiflib/issues/11; https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a
CVE: CVE-2019-16347
Published: 2019-09-16
Description: ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682, CWE-787
References: https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a; https://github.com/miniupnp/ngiflib/issues/12; https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a
CVE: CVE-2019-16348
Published: 2019-09-16
Description: marc-q libwav through 2017-04-20 has a NULL pointer dereference in gain_file() at wav_gain.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/marc-q/libwav/issues/24; https://github.com/marc-q/libwav/issues/24
CVE: CVE-2019-16349
Published: 2019-09-16
Description: Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/422; https://github.com/axiomatic-systems/Bento4/issues/422
CVE: CVE-2019-16350
Published: 2019-09-16
Description: ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/rockcarry/ffjpeg/issues/10; https://github.com/rockcarry/ffjpeg/issues/10
CVE: CVE-2019-16351
Published: 2019-09-16
Description: ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/rockcarry/ffjpeg/issues/11; https://github.com/rockcarry/ffjpeg/issues/11
CVE: CVE-2019-16352
Published: 2019-09-16
Description: ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/rockcarry/ffjpeg/issues/12; https://github.com/rockcarry/ffjpeg/issues/12
CVE: CVE-2019-16353
Published: 2019-09-16
Description: Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by an RX7i device.
CVSS Score: 7.5 (HIGH)
References: https://github.com/boofish/GE_Proficy_Machine_Edition_Vuln/blob/master/README.md; https://github.com/boofish/GE_Proficy_Machine_Edition_Vuln/blob/master/README.md
CVE: CVE-2019-16354
Published: 2019-09-16
Description: The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-732
References: https://github.com/astaxie/beego/issues/3763; https://github.com/astaxie/beego/issues/3763
CVE: CVE-2019-16355
Published: 2019-09-16
Description: The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/astaxie/beego/issues/3763; https://github.com/astaxie/beego/issues/3763