deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15799
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. User accounts created through the web interface of the device, when given non-admin level privileges, have the same level of privileged access as administrators when connecting to the device via SSH (while their permissions via the web interface are in fact restricted). This allows normal users to obtain the administrative password by running the tech-support command via the CLI: this contains the encrypted passwords for all users on the device. As these passwords are encrypted using well-known and static parameters, they can be decrypted and the original passwords (including the administrator password) can be obtained.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://vimeo.com/354726424; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml
CVE: CVE-2019-15800
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml; https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
CVE: CVE-2019-15801
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authenticate users wishing to access a diagnostics or password-recovery menu. Using the hardcoded cryptographic key found elsewhere in the firmware, these passwords can be decrypted. This is related to fds_sys_passDebugPasswd_ret() and fds_sys_passRecoveryPasswd_ret() in libfds.so.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml; https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
CVE: CVE-2019-15802
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml; https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
CVE: CVE-2019-15803
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Through an undocumented sequence of keypresses, undocumented functionality is triggered. A diagnostics shell is triggered via CTRL-ALT-t, which prompts for the password returned by fds_sys_passDebugPasswd_ret(). The firmware contains access control checks that determine if remote users are allowed to access this functionality. The function that performs this check (fds_sys_remoteDebugEnable_ret in libfds.so) always return TRUE with no actual checks performed. The diagnostics menu allows for reading/writing arbitrary registers and various other configuration parameters which are believed to be related to the network interface chips.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml; https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
CVE: CVE-2019-15804
Published: 2019-11-14
Description: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+\ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains "Password recovery for specific user" options. The menu is believed to be accessible using a serial console.
CVSS Score: 7.5 (HIGH)
References: https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html; https://www.zyxel.com/support/gs1900-switch-vulnerabilities.shtml; https://jasper.la/exploring-zyxel-gs1900-firmware-with-ghidra.html
CVE: CVE-2019-17391
Published: 2019-11-14
Description: An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-755
References: https://www.espressif.com/en/news/Security_Advisory_Concerning_Fault_Injection_and_eFuse_Protections; https://www.espressif.com/en/news/Security_Advisory_Concerning_Fault_Injection_and_eFuse_Protections
CVE: CVE-2019-18651
Published: 2019-11-14
Description: A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts. The user needs to have an active privileged session.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://gitlab.com/crypt0crc/cve-2019-18651; https://gitlab.com/crypt0crc/cve-2019-18651
CVE: CVE-2019-18978
Published: 2019-11-14
Description: An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/cyu/rack-cors/commit/e4d4fc362a[PII_REDACTED]011cbe5afcfe5486f17d; https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4; https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html
CVE: CVE-2019-18980
Published: 2019-11-14
Description: On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb[PII_REDACTED] devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The only requirement is that the attacker have network access to the bulb.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-311
References: https://blog.dammitly.net/2019/10/cheap-hackable-wifi-light-bulbs-or-iot.html; https://blog.dammitly.net/2019/10/cheap-hackable-wifi-light-bulbs-or-iot.html
CVE: CVE-2019-11931
Published: 2019-11-14
Description: A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.facebook.com/security/advisories/cve-2019-11931; https://www.facebook.com/security/advisories/cve-2019-11931
CVE: CVE-2019-18928
Published: 2019-11-15
Description: Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/
CVE: CVE-2019-18981
Published: 2019-11-15
Description: Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-838
References: https://github.com/pimcore/pimcore/commit/0a5d80b2593b2ebe35d19756b730ba33aa049106; https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2; https://github.com/pimcore/pimcore/commit/0a5d80b2593b2ebe35d19756b730ba33aa049106
CVE: CVE-2019-18982
Published: 2019-11-15
Description: bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78; https://github.com/pimcore/pimcore/compare/v6.2.3...v6.3.0; https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78
CVE: CVE-2019-18985
Published: 2019-11-15
Description: Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2d; https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2; https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2d
CVE: CVE-2019-18986
Published: 2019-11-15
Description: Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://github.com/pimcore/pimcore/commit/4a7bba5c3f818852cbbd29fa124f7fb09a207185; https://github.com/pimcore/pimcore/compare/v6.2.1...v6.2.2; https://github.com/pimcore/pimcore/commit/4a7bba5c3f818852cbbd29fa124f7fb09a207185
CVE: CVE-2019-18987
Published: 2019-11-15
Description: An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public, its previous versions can be exposed, thus potentially disclosing private or sensitive information within the filter's definition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/Ic12790bd33982473f77551bde9599ed083a3e1f1; https://phabricator.wikimedia.org/T237887; https://www.mediawiki.org/wiki/Extension:AbuseFilter
CVE: CVE-2019-14869
Published: 2019-11-15
Description: A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-648, CWE-732
References: http://jvn.jp/en/jp/JVN52486659/index.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00049.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00050.html
CVE: CVE-2019-14343
Published: 2019-11-15
Description: TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155376/TemaTres-3.0-Cross-Site-Scripting.html; https://github.com/tematres/TemaTres-Vocabulary-Server/commits/master; https://medium.com/%40Pablo0xSantiago/cve-2019-14343-ebc120800053
CVE: CVE-2019-14345
Published: 2019-11-15
Description: TemaTres 3.0 allows remote unprivileged users to create an administrator account
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/tematres/TemaTres-Vocabulary-Server/commits/master; https://medium.com/%40Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f; https://sourceforge.net/p/tematres/mailman/tematres-help/
CVE: CVE-2013-4584
Published: 2019-11-15
Description: Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755
References: http://www.openwall.com/lists/oss-security/2013/11/15/6; http://www.securityfocus.com/bid/63696; https://access.redhat.com/security/cve/cve-2013-4584
CVE: CVE-2013-7087
Published: 2019-11-15
Description: ClamAV before 0.97.7 has WWPack corrupt heap memory
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://security.gentoo.org/glsa/glsa-201405-08.xml; http://www.openwall.com/lists/oss-security/2013/12/13/1; http://www.securityfocus.com/bid/58546
CVE: CVE-2013-7088
Published: 2019-11-15
Description: ClamAV before 0.97.7 has buffer overflow in the libclamav component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://security.gentoo.org/glsa/glsa-201405-08.xml; http://www.openwall.com/lists/oss-security/2013/12/13/1; http://www.securityfocus.com/bid/58546
CVE: CVE-2013-7089
Published: 2019-11-15
Description: ClamAV before 0.97.7: dbg_printhex possible information leak
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://security.gentoo.org/glsa/glsa-201405-08.xml; http://www.openwall.com/lists/oss-security/2013/12/13/1; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7089
CVE: CVE-2014-0021
Published: 2019-11-15
Description: Chrony before 1.29.1 has traffic amplification in cmdmon protocol
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html; http://www.openwall.com/lists/oss-security/2014/01/17/9
CVE: CVE-2014-0023
Published: 2019-11-15
Description: OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://access.redhat.com/security/cve/cve-2014-0023; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0023; https://access.redhat.com/security/cve/cve-2014-0023
CVE: CVE-2009-5047
Published: 2019-11-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-4611. Reason: This candidate is a duplicate of CVE-2009-4611. Notes: All CVE users should reference CVE-2009-4611 rather than this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-5285
Published: 2019-11-15
Description: A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html; http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
CVE: CVE-2011-0703
Published: 2019-11-15
Description: In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://access.redhat.com/security/cve/cve-2011-0703; https://security-tracker.debian.org/tracker/CVE-2011-0703; https://access.redhat.com/security/cve/cve-2011-0703
CVE: CVE-2011-2726
Published: 2019-11-15
Description: An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2012/03/19/10; http://www.openwall.com/lists/oss-security/2012/03/20/14; https://access.redhat.com/security/cve/cve-2011-2726
CVE: CVE-2011-2910
Published: 2019-11-15
Description: The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://access.redhat.com/security/cve/cve-2011-2910; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2910; https://security-tracker.debian.org/tracker/CVE-2011-2910
CVE: CVE-2018-18368
Published: 2019-11-15
Description: Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.symantec.com/us/en/article.SYMSA1488.html; https://support.symantec.com/us/en/article.SYMSA1488.html
CVE: CVE-2019-12756
Published: 2019-11-15
Description: Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password protection could by bypassed for individuals with local administrator rights.
CVSS Score: 2.3 (LOW)
References: https://support.symantec.com/us/en/article.SYMSA1488.html; https://support.symantec.com/us/en/article.SYMSA1488.html
CVE: CVE-2011-2916
Published: 2019-11-15
Description: qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://access.redhat.com/security/cve/cve-2011-2916; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2916; https://security-tracker.debian.org/tracker/CVE-2011-2916
CVE: CVE-2019-12757
Published: 2019-11-15
Description: Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d (12.1.7510.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
References: https://support.symantec.com/us/en/article.SYMSA1488.html; https://support.symantec.com/us/en/article.SYMSA1488.html
CVE: CVE-2019-12758
Published: 2019-11-15
Description: Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code without a resident proper digital signature.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://safebreach.com/Post/Symantec-Endpoint-Protection-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-12758; https://support.symantec.com/us/en/article.SYMSA1488.html; https://safebreach.com/Post/Symantec-Endpoint-Protection-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-12758
CVE: CVE-2019-12759
Published: 2019-11-15
Description: Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
References: https://support.symantec.com/us/en/article.SYMSA1488.html; https://support.symantec.com/us/en/article.SYMSA1488.html
CVE: CVE-2019-18372
Published: 2019-11-15
Description: Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
References: https://support.symantec.com/us/en/article.SYMSA1488.html; https://support.symantec.com/us/en/article.SYMSA1488.html
CVE: CVE-2019-13581
Published: 2019-11-15
Description: An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary code via malformed Wi-Fi packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://keenlab.tencent.com/en/2020/01/02/exploiting-wifi-stack-on-tesla-model-s/; https://www.marvell.com/documents/ioaj5dntk2ubykssa78s/; https://keenlab.tencent.com/en/2020/01/02/exploiting-wifi-stack-on-tesla-model-s/
CVE: CVE-2019-13582
Published: 2019-11-15
Description: An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.marvell.com/documents/ioaj5dntk2ubykssa78s/; https://www.marvell.com/documents/ioaj5dntk2ubykssa78s/
CVE: CVE-2019-6659
Published: 2019-11-15
Description: On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K34450231; https://support.f5.com/csp/article/K34450231
CVE: CVE-2019-6660
Published: 2019-11-15
Description: On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K23860356; https://support.f5.com/csp/article/K23860356
CVE: CVE-2019-6661
Published: 2019-11-15
Description: When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.f5.com/csp/article/K61705126; https://support.f5.com/csp/article/K61705126
CVE: CVE-2019-6662
Published: 2019-11-15
Description: On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://support.f5.com/csp/article/K01049383; https://support.f5.com/csp/article/K01049383