deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-02-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  This issue lacks details and  cannot be determined if it is a security issue or not.  Notes: none
CVE: CVE-2019-8935
Published: 2019-02-19
Description: Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.netsparker.com/web-applications-advisories/ns-18-052-reflected-cross-site-scripting-in-collabtive/; https://www.netsparker.com/web-applications-advisories/ns-18-052-reflected-cross-site-scripting-in-collabtive/
CVE: CVE-2019-8939
Published: 2019-02-19
Description: data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107171; https://github.com/Tautulli/Tautulli-Issues/issues/161; http://www.securityfocus.com/bid/107171
CVE: CVE-2018-1996
Published: 2019-02-19
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: http://www.securityfocus.com/bid/107155; https://exchange.xforce.ibmcloud.com/vulnerabilities/154650; https://www.ibm.com/support/docview.wss?uid=ibm10793421
CVE: CVE-2019-5754
Published: 2019-02-19
Description: Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5755
Published: 2019-02-19
Description: Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5756
Published: 2019-02-19
Description: Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5757
Published: 2019-02-19
Description: An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5758
Published: 2019-02-19
Description: Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5759
Published: 2019-02-19
Description: Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5760
Published: 2019-02-19
Description: Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5761
Published: 2019-02-19
Description: Incorrect object lifecycle management in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5762
Published: 2019-02-19
Description: Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5763
Published: 2019-02-19
Description: Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-754
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5764
Published: 2019-02-19
Description: Incorrect pointer management in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5765
Published: 2019-02-19
Description: An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5766
Published: 2019-02-19
Description: Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html; https://crbug.com/907047
CVE: CVE-2019-5767
Published: 2019-02-19
Description: Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5768
Published: 2019-02-19
Description: DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5769
Published: 2019-02-19
Description: Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html; https://crbug.com/913975
CVE: CVE-2019-5770
Published: 2019-02-19
Description: Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5771
Published: 2019-02-19
Description: An incorrect JIT of GLSL shaders in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5772
Published: 2019-02-19
Description: Sharing of objects over calls into JavaScript runtime in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5773
Published: 2019-02-19
Description: Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5774
Published: 2019-02-19
Description: Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who convinced a user to download a .desktop file to execute arbitrary code via a downloaded .desktop file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5775
Published: 2019-02-19
Description: Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5776
Published: 2019-02-19
Description: Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5777
Published: 2019-02-19
Description: Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5778
Published: 2019-02-19
Description: A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5779
Published: 2019-02-19
Description: Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5780
Published: 2019-02-19
Description: Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5781
Published: 2019-02-19
Description: Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5782
Published: 2019-02-19
Description: Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://www.securityfocus.com/bid/106767; https://access.redhat.com/errata/RHSA-2019:0309; https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
CVE: CVE-2019-5783
Published: 2019-02-19
Description: Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html; https://crbug.com/895081; https://www.debian.org/security/2019/dsa-4395
CVE: CVE-2018-20025
Published: 2019-02-19
Description: Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://www.securityfocus.com/bid/106251; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-037-codesys-control-v3-use-of-insufficiently-random-values/; https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
CVE: CVE-2018-20026
Published: 2019-02-19
Description: Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/106251; https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-036-codesys-control-v3-improper-communication-address-filtering/; https://ics-cert.us-cert.gov/advisories/ICSA-18-352-04
CVE: CVE-2018-9867
Published: 2019-02-19
Description: In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285, CWE-732
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0017; https://www.tenable.com/security/research/tra-2019-08; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0017
CVE: CVE-2019-7164
Published: 2019-02-20
Description: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
CVE: CVE-2018-19106
Published: 2019-02-20
Description: Avi Vantage before 17.2.13 uses an invalid URL encoding during a redirect operation, aka AV-33959.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://avinetworks.com/docs/17.2/release-notes/; https://avinetworks.com/docs/17.2/release-notes/
CVE: CVE-2019-8942
Published: 2019-02-20
Description: WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html; http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce; http://www.securityfocus.com/bid/107088
CVE: CVE-2019-8943
Published: 2019-02-20
Description: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html; http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.html; http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce
CVE: CVE-2019-8944
Published: 2019-02-20
Description: An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/OctopusDeploy/Issues/issues/5314; https://github.com/OctopusDeploy/Issues/issues/5315; https://github.com/OctopusDeploy/Issues/issues/5314
CVE: CVE-2019-8948
Published: 2019-02-20
Description: PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://www.papercut.com/products/mf/release-history/; https://www.papercut.com/products/ng/release-history/; https://www.papercut.com/products/mf/release-history/
CVE: CVE-2019-8950
Published: 2019-02-20
Description: The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://blog.burghardt.pl/2019/02/dasan-h665-has-vendor-backdoor-built-into-busyboxs-bin-login/; https://seclists.org/bugtraq/2019/Feb/32; https://blog.burghardt.pl/2019/02/dasan-h665-has-vendor-backdoor-built-into-busyboxs-bin-login/
CVE: CVE-2018-20240
Published: 2019-02-20
Description: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107128; https://jira.atlassian.com/browse/CRUC-8381; https://jira.atlassian.com/browse/FE-7163
CVE: CVE-2018-20241
Published: 2019-02-20
Description: The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107128; https://jira.atlassian.com/browse/CRUC-8380; https://jira.atlassian.com/browse/FE-7162
CVE: CVE-2019-8331
Published: 2019-02-20
Description: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html; http://seclists.org/fulldisclosure/2019/May/10; http://seclists.org/fulldisclosure/2019/May/11
CVE: CVE-2019-8953
Published: 2019-02-20
Description: The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://github.com/pfsense/FreeBSD-ports/commit/2dded47b3202dfdf89aa96f84bf701b3d5acbe6c; https://github.com/pfsense/FreeBSD-ports/commit/3b40366aca55910b224ecf49d3fdacc9ad6c04f5
CVE: CVE-2018-20030
Published: 2019-02-20
Description: An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89
CVE: CVE-2019-8954
Published: 2019-02-20
Description: In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.iwantacve.cn/index.php/archives/112/; http://www.iwantacve.cn/index.php/archives/112/
CVE: CVE-2018-5817
Published: 2019-02-20
Description: A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/; https://usn.ubuntu.com/3989-1/
CVE: CVE-2018-5818
Published: 2019-02-20
Description: An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html; https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/; https://usn.ubuntu.com/3989-1/