deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9925
Published: 2019-03-22
Description: S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.iwantacve.cn/index.php/archives/163/; http://www.iwantacve.cn/index.php/archives/163/
CVE: CVE-2019-9927
Published: 2019-03-22
Description: Caret before 2019-02-22 allows Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/careteditor/issues/issues/862; https://github.com/careteditor/issues/issues/862
CVE: CVE-2019-9936
Published: 2019-03-22
Description: In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html; http://www.securityfocus.com/bid/107562; https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
CVE: CVE-2019-9937
Published: 2019-03-22
Description: In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html; http://www.securityfocus.com/bid/107562; https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
CVE: CVE-2019-9938
Published: 2019-03-22
Description: The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The attacker must be authenticated as a "recognized device."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files/; https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files/
CVE: CVE-2019-9939
Published: 2019-03-22
Description: The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requested, the application responds with a 200 status code and empty page, and adds the requesting client device into the list of recognized devices.
CVSS Score: 8.8 (HIGH)
References: https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files/; https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files/
CVE: CVE-2019-4035
Published: 2019-03-22
Description: IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X-Force ID: 156001.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=ibm10869060; http://www.securityfocus.com/bid/107557; https://exchange.xforce.ibmcloud.com/vulnerabilities/156001
CVE: CVE-2019-4052
Published: 2019-03-22
Description: IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVSS Score: 7.5 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=ibm10874248; http://www.securityfocus.com/bid/107559; https://exchange.xforce.ibmcloud.com/vulnerabilities/156544
CVE: CVE-2019-9648
Published: 2019-03-22
Description: An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/154204/CoreFTP-Server-SIZE-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/Aug/21; http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
CVE: CVE-2018-20165
Published: 2019-03-22
Description: Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/hect0rS/Reflected-XSS-on-Opentext-Portal-v7.4.4/blob/master/readme.md; https://github.com/hect0rS/Reflected-XSS-on-Opentext-Portal-v7.4.4/blob/master/readme.md
CVE: CVE-2019-1716
Published: 2019-03-22
Description: A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability exists because the software improperly validates user-supplied input during user authentication. An attacker could exploit this vulnerability by connecting to an affected device using HTTP and supplying malicious user credentials. A successful exploit could allow the attacker to trigger a reload of an affected device, resulting in a DoS condition, or to execute arbitrary code with the privileges of the app user. Cisco fixed this vulnerability in the following SIP Software releases: 10.3(1)SR5 and later for Cisco Unified IP Conference Phone 8831; 11.0(4)SR3 and later for Cisco Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 and later for the rest of the Cisco IP Phone 7800 Series and 8800 Series.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-rce; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-rce
CVE: CVE-2019-1763
Published: 2019-03-22
Description: A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to critical services and cause a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipab; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipab
CVE: CVE-2019-1764
Published: 2019-03-22
Description: A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series. Cisco IP Conference Phone 8831 is not affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-csrf; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ip-phone-csrf
CVE: CVE-2019-1765
Published: 2019-03-22
Description: A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level permissions. An attacker could exploit this vulnerability by uploading invalid files to an affected device. A successful exploit could allow the attacker to write files in arbitrary locations on the filesystem. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 11.0(5) for Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipptv; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipptv
CVE: CVE-2019-1766
Published: 2019-03-22
Description: A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 12.5(1)SR1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipfudos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipfudos
CVE: CVE-2019-9649
Published: 2019-03-22
Description: An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/154205/CoreFTP-Server-MDTM-Directory-Traversal.html; http://seclists.org/fulldisclosure/2019/Aug/22; http://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509
CVE: CVE-2019-9942
Published: 2019-03-23
Description: A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
CVSS Score: 3.7 (LOW)
References: https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077; https://seclists.org/bugtraq/2019/Mar/60; https://symfony.com/blog/twig-sandbox-information-disclosure
CVE: CVE-2019-9945
Published: 2019-03-23
Description: SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user credentials. If customers have not followed SoftNAS deployment best practices and expose SoftNAS StorageCenter ports directly to the internet, this vulnerability allows an attacker to gain access to the Webadmin interface to create new users or execute arbitrary commands with administrative privileges, compromising both the platform and the data.
CVSS Score: 9.8 (CRITICAL)
References: https://www.digitaldefense.com/blog/2019-softnas-cloud-zero-day-blog/; https://www.digitaldefense.com/blog/2019-softnas-cloud-zero-day-blog/
CVE: CVE-2019-9947
Published: 2019-03-23
Description: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE: CVE-2019-9948
Published: 2019-03-23
Description: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html; http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
CVE: CVE-2016-10743
Published: 2019-03-23
Description: hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-332
References: http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html; http://seclists.org/fulldisclosure/2020/Feb/26; http://www.openwall.com/lists/oss-security/2020/02/27/1
CVE: CVE-2015-3965
Published: 2019-03-23
Description: Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01; https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01
CVE: CVE-2019-9956
Published: 2019-03-24
Description: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00010.html; http://www.securityfocus.com/bid/107546
CVE: CVE-2019-9960
Published: 2019-03-24
Description: The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/LimeSurvey/LimeSurvey/commit/1ed10d3c423187712b8f6a8cb2bc9d5cc3b2deb8; https://github.com/LimeSurvey/LimeSurvey/commit/1ed10d3c423187712b8f6a8cb2bc9d5cc3b2deb8
CVE: CVE-2019-9962
Published: 2019-03-24
Description: XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to VCRUNTIME140!memcpy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9963
Published: 2019-03-24
Description: XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlFreeHeap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9964
Published: 2019-03-24
Description: XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlpNtMakeTemporaryKey.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9965
Published: 2019-03-24
Description: XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlReAllocateHeap.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9966
Published: 2019-03-24
Description: XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x38536c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9967
Published: 2019-03-24
Description: XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlPrefixUnicodeString.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9968
Published: 2019-03-24
Description: XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to ntdll!RtlQueueWorkItem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9969
Published: 2019-03-24
Description: XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to xnview+0x385399.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://code610.blogspot.com/2019/03/crashing-xnview-248.html; https://code610.blogspot.com/2019/03/crashing-xnview-248.html
CVE: CVE-2019-9970
Published: 2019-03-24
Description: Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/107550; https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt; http://www.securityfocus.com/bid/107550
CVE: CVE-2019-9977
Published: 2019-03-24
Description: The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code execution, and display a crafted message to vehicle occupants.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/107551; https://twitter.com/thezdi/status/[PII_REDACTED]51859456; https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-contest/
CVE: CVE-2019-9978
Published: 2019-03-24
Description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html; http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html; https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html
CVE: CVE-2019-10010
Published: 2019-03-24
Description: Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/thephpleague/commonmark/issues/353; https://github.com/thephpleague/commonmark/releases/tag/0.18.3; https://github.com/thephpleague/commonmark/issues/353
CVE: CVE-2019-10014
Published: 2019-03-24
Description: In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://blog.csdn.net/yalecaltech/article/details/88594388; https://blog.csdn.net/yalecaltech/article/details/88594388
CVE: CVE-2019-10015
Published: 2019-03-24
Description: baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/baigoStudio/baigoSSO/issues/12; https://github.com/baigoStudio/baigoSSO/issues/12
CVE: CVE-2019-10017
Published: 2019-03-24
Description: CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12001; https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/; http://dev.cmsmadesimple.org/bug/view/12001
CVE: CVE-2019-10018
Published: 2019-03-25
Description: An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276; https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html; https://usn.ubuntu.com/4042-1/
CVE: CVE-2019-10019
Published: 2019-03-25
Description: An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41275; https://usn.ubuntu.com/4042-1/; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41275
CVE: CVE-2019-10020
Published: 2019-03-25
Description: An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41274