deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-2306
Published: 2019-07-25
Description: Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-704
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2307
Published: 2019-07-25
Description: Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-191
References: http://www.securityfocus.com/bid/109383; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; http://www.securityfocus.com/bid/109383
CVE: CVE-2019-2308
Published: 2019-07-25
Description: User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subsystem in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2309
Published: 2019-07-25
Description: While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SDM660, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2312
Published: 2019-07-25
Description: When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, MDM9640, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDM630, SDM660, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2314
Published: 2019-07-25
Description: Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDM660, SDX20, SDX24
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2316
Published: 2019-07-25
Description: When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM660, SDX24
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2322
Published: 2019-07-25
Description: Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2326
Published: 2019-07-25
Description: Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2327
Published: 2019-07-25
Description: Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2328
Published: 2019-07-25
Description: Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2330
Published: 2019-07-25
Description: improper input validation in allocation request for secure allocations can lead to page fault. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2334
Published: 2019-07-25
Description: Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2343
Published: 2019-07-25
Description: Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-2345
Published: 2019-07-25
Description: Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM660, SDX20, SDX24
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin; https://www.codeaurora.org/security-bulletin/2019/07/01/july-2019-code-aurora-security-bulletin
CVE: CVE-2019-2346
Published: 2019-07-25
Description: Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, QCA8081, QCS404, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2019-3621
Published: 2019-07-25
Description: Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/109370; https://kc.mcafee.com/corporate/index?page=content&id=SB10290; http://www.securityfocus.com/bid/109370
CVE: CVE-2019-9884
Published: 2019-07-25
Description: eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-425
References: http://surl.twcert.org.tw/b7jfz; https://tvn.twcert.org.tw/taiwanvn/TVN-201904004; https://zeroday.hitcon.org/vulnerability/ZD-2019-00332
CVE: CVE-2019-9885
Published: 2019-07-25
Description: eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://surl.twcert.org.tw/eBDZP; https://tvn.twcert.org.tw/taiwanvn/TVN-201904005; https://zeroday.hitcon.org/vulnerability/ZD-2019-00333
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-25
Description: VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.google.com/document/d/e/2PACX-1vQJveVcGMp_NMdBY5Je2K2k63RoCYznvKjJk5u1wJRmLotvwQkG5qiqZjpABcOkjzj49wkwGweiFwrc/pub; https://github.com/vcftools/vcftools/issues/141; https://docs.google.com/document/d/e/2PACX-1vQJveVcGMp_NMdBY5Je2K2k63RoCYznvKjJk5u1wJRmLotvwQkG5qiqZjpABcOkjzj49wkwGweiFwrc/pub
CVE: CVE-2019-13483
Published: 2019-07-25
Description: Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
CVSS Score: 7.3 (HIGH)
CWE: CWE-345
References: https://auth0.com/docs/security/bulletins/cve-2019-13483; https://auth0.com/docs/security/bulletins/cve-2019-13483
CVE: CVE-2019-13917
Published: 2019-07-25
Description: Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g., $local_part or $domain).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://exim.org/static/doc/security/CVE-2019-13917.txt; http://www.openwall.com/lists/oss-security/2019/07/26/5; https://seclists.org/bugtraq/2019/Jul/51
CVE: CVE-2019-10184
Published: 2019-07-25
Description: undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/errata/RHSA-2019:2935; https://access.redhat.com/errata/RHSA-2019:2936; https://access.redhat.com/errata/RHSA-2019:2937
CVE: CVE-2019-11921
Published: 2019-07-25
Description: An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/facebook/proxygen/commit/2f07985bef9fbae124cc63e5c0272e32da4fdaec; https://www.facebook.com/security/advisories/cve-2019-11921; https://github.com/facebook/proxygen/commit/2f07985bef9fbae124cc63e5c0272e32da4fdaec
CVE: CVE-2019-11922
Published: 2019-07-25
Description: A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00078.html
CVE: CVE-2018-11779
Published: 2019-07-26
Description: In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98%40%3Cuser.storm.apache.org%3E; https://lists.apache.org/thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98%40%3Cuser.storm.apache.org%3E
CVE: CVE-2019-0202
Published: 2019-07-26
Description: The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-532
References: https://lists.apache.org/thread.html/220f1a77ff20749326a4c130446c5521db854da0afe81d1974b8109f%40%3Cuser.storm.apache.org%3E; https://lists.apache.org/thread.html/220f1a77ff20749326a4c130446c5521db854da0afe81d1974b8109f%40%3Cuser.storm.apache.org%3E
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-26
Description: Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/open?id=1sk5IklziyEggeWpWE4Wyk9xqa30CjNpS; https://drive.google.com/open?id=1sk5IklziyEggeWpWE4Wyk9xqa30CjNpS
CVE: CVE-2019-10744
Published: 2019-07-26
Description: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1321
References: https://access.redhat.com/errata/RHSA-2019:3024; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/vuln/SNYK-JS-LODASH-450202
CVE: CVE-2019-10972
Published: 2019-07-26
Description: Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project file (.frc2). Once a user opens the rogue project, CPU exhaustion occurs, which causes the software to quit responding until the application is restarted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://www.us-cert.gov/ics/advisories/icsa-19-204-01; https://www.us-cert.gov/ics/advisories/icsa-19-204-01
CVE: CVE-2019-10974
Published: 2019-07-26
Description: NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten with arbitrary code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-204-02; https://www.us-cert.gov/ics/advisories/icsa-19-204-02
CVE: CVE-2019-10976
Published: 2019-07-26
Description: Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.us-cert.gov/ics/advisories/icsa-19-204-01; https://www.us-cert.gov/ics/advisories/icsa-19-204-01
CVE: CVE-2019-5603
Published: 2019-07-26
Description: In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, system calls operating on file descriptors as part of mqueuefs did not properly release the reference allowing a malicious user to overflow the counter allowing access to files, directories, and sockets opened by processes owned by other users.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://packetstormsecurity.com/files/153752/FreeBSD-Security-Advisory-FreeBSD-SA-19-15.mqueuefs.html; http://packetstormsecurity.com/files/154172/FreeBSD-Security-Advisory-FreeBSD-SA-19-24.mqueuefs.html; https://seclists.org/bugtraq/2019/Aug/35
CVE: CVE-2019-5604
Published: 2019-07-26
Description: In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, the emulated XHCI device included with the bhyve hypervisor did not properly validate data provided by the guest, allowing an out-of-bounds read. This provides a malicious guest the possibility to crash the system or access system memory.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-125
References: http://packetstormsecurity.com/files/153753/FreeBSD-Security-Advisory-FreeBSD-SA-19-16.bhyve.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:16.bhyve.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-5605
Published: 2019-07-26
Description: In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient initialization of memory copied to userland in the freebsd32_ioctl interface, small amounts of kernel memory may be disclosed to userland processes. This may allow an attacker to leverage this information to obtain elevated privileges either directly or indirectly.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665
References: http://packetstormsecurity.com/files/153749/FreeBSD-Security-Advisory-FreeBSD-SA-19-14.freebsd32.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-19:14.freebsd32.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/