deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5639
Published: 2019-12-20
Description: LibreOffice and OpenOffice automatically open embedded content
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2012/12/14/1; http://www.openwall.com/lists/oss-security/2023/12/28/6; http://www.openwall.com/lists/oss-security/2024/01/03/6
CVE: CVE-2015-8313
Published: 2019-12-20
Description: GnuTLS incorrectly validates the first byte of padding in CBC modes
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: http://www.debian.org/security/2015/dsa-3408; http://www.securityfocus.com/archive/1/537012/100/0/threaded; http://www.securityfocus.com/bid/78327
CVE: CVE-2[PII_REDACTED]
Published: 2019-12-20
Description: swagger-ui has XSS in key names
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97580; https://access.redhat.com/errata/RHSA-2017:0868; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2[PII_REDACTED]
CVE: CVE-2012-6094
Published: 2019-12-20
Description: cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2013/01/04/5; http://www.securityfocus.com/bid/57158; https://access.redhat.com/security/cve/cve-2012-6094
CVE: CVE-2012-6111
Published: 2019-12-20
Description: gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2013/01/17/4; https://access.redhat.com/security/cve/cve-2012-6111; https://bugzilla.gnome.org/show_bug.cgi?id=690466
CVE: CVE-2019-17440
Published: 2019-12-20
Description: Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. This issue does not affect PAN-OS 8.1 or prior releases. This issue only affected a very limited number of customers and we undertook individual outreach to help them upgrade. At the time of publication, all identified customers have upgraded SW or content and are not impacted.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-923
References: https://security.paloaltonetworks.com/CVE-2019-17440; https://security.paloaltonetworks.com/CVE-2019-17440
CVE: CVE-2019-18263
Published: 2019-12-20
Description: An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewForum option (shipped between 2016-August 2018), Pulsera (718095) and Endura (718075) with wireless option (shipped between 26-June-2017 through 07-August 2018), Pulsera (718095) and Endura (718075) with ViewForum option (shipped between 26-June-2017 through 07-August 2018). The router software uses an encryption scheme that is not strong enough for the level of protection required.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.us-cert.gov/ics/advisories/icsma-19-353-01; https://www.us-cert.gov/ics/advisories/icsma-19-353-01
CVE: CVE-2019-19691
Published: 2019-12-20
Description: A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page elements using development tools. Note that the attacker must already have admin/root privileges on the product console to exploit this vulnerability.
CVSS Score: 4.9 (MEDIUM)
References: https://success.trendmicro.com/solution/000159568; https://success.trendmicro.com/solution/000159568
CVE: CVE-2019-19692
Published: 2019-12-20
Description: Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console. Note that the Japanese version of the product is NOT affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/solution/000159569; https://success.trendmicro.com/solution/000159569
CVE: CVE-2019-19693
Published: 2019-12-20
Description: The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to create a denial-of-service condition on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124043.aspx; https://www.zerodayinitiative.com/advisories/ZDI-19-1025/; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124043.aspx
CVE: CVE-2019-19916
Published: 2019-12-20
Description: In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting (XSS) and other attacks when the product renders the content as HTML. Remediating this would also need to consider the polyglot case, e.g., a file that is a valid GIF image and also valid JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/; https://github.com/V1n1v131r4/MIME-Confusion-Attack-on-Midori-Browser/blob/master/README.md; https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs
CVE: CVE-2018-1934
Published: 2019-12-20
Description: IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153179; https://www.ibm.com/support/pages/node/1142626; https://exchange.xforce.ibmcloud.com/vulnerabilities/153179
CVE: CVE-2019-15910
Published: 2019-12-20
Description: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15910.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15910.md
CVE: CVE-2019-15911
Published: 2019-12-20
Description: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication, attackers can obtain sensitive information, cause the multiple denial of service attacks, take over smart home devices, and tamper with messages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15911.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15911.md
CVE: CVE-2019-15912
Published: 2019-12-20
Description: An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15912_1.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15912_2.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15912_1.md
CVE: CVE-2019-15913
Published: 2019-12-20
Description: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee communication, causing attackers to gain sensitive information and denial of service attack, take over smart home devices, and tamper with messages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15913.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15913.md
CVE: CVE-2019-15914
Published: 2019-12-20
Description: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15914_1.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15914_2.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15914_1.md
CVE: CVE-2019-15915
Published: 2019-12-20
Description: An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices. Attackers can utilize the "discover ZigBee network procedure" to perform a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15915.md; https://github.com/chengcheng227/CVE-POC/blob/master/CVE-2019-15915.md
CVE: CVE-2019-17571
Published: 2019-12-20
Description: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html; https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E; https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f[PII_REDACTED]e3e14761c%40%3Cdev.tika.apache.org%3E
CVE: CVE-2019-19747
Published: 2019-12-20
Description: NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://neuvector.com/container-security/blog/; https://paulrobertson.co.za/cve-2019-19747/; https://neuvector.com/container-security/blog/
CVE: CVE-2019-4231
Published: 2019-12-20
Description: IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159356; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/1138588
CVE: CVE-2019-4555
Published: 2019-12-20
Description: IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166204.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/166204; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/1138588
CVE: CVE-2019-4736
Published: 2019-12-20
Description: IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172706; https://www.ibm.com/support/pages/node/1135173; https://exchange.xforce.ibmcloud.com/vulnerabilities/172706
CVE: CVE-2019-4742
Published: 2019-12-20
Description: IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 172877.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172877; https://www.ibm.com/support/pages/node/1135173; https://exchange.xforce.ibmcloud.com/vulnerabilities/172877
CVE: CVE-2019-4743
Published: 2019-12-20
Description: IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172880.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172880; https://www.ibm.com/support/pages/node/1135173; https://exchange.xforce.ibmcloud.com/vulnerabilities/172880
CVE: CVE-2019-4744
Published: 2019-12-20
Description: IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172882.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172882; https://www.ibm.com/support/pages/node/1135173; https://exchange.xforce.ibmcloud.com/vulnerabilities/172882
CVE: CVE-2019-19917
Published: 2019-12-20
Description: Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00010.html
CVE: CVE-2019-19918
Published: 2019-12-20
Description: Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00010.html
CVE: CVE-2019-15584
Published: 2019-12-20
Description: A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://hackerone.com/reports/670572; https://hackerone.com/reports/670572
CVE: CVE-2019-19231
Published: 2019-12-20
Description: An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-65
References: http://packetstormsecurity.com/files/155758/CA-Client-Automation-14.x-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2020/Jan/5; https://seclists.org/bugtraq/2019/Dec/41
CVE: CVE-2019-16785
Published: 2019-12-20
Description: Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-444, CWE-444
References: https://access.redhat.com/errata/RHSA-2020:0720; https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes; https://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba
CVE: CVE-2019-16786
Published: 2019-12-20
Description: Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-444, CWE-444
References: https://access.redhat.com/errata/RHSA-2020:0720; https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes; https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3
CVE: CVE-2019-16787
Published: 2019-12-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-19905. Reason: This candidate is a duplicate of CVE-2019-19905. Notes: All CVE users should reference CVE-2019-19905 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-19919
Published: 2019-12-20
Description: Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://www.npmjs.com/advisories/1164; https://www.tenable.com/security/tns-2021-14; https://www.npmjs.com/advisories/1164
CVE: CVE-2019-19920
Published: 2019-12-22
Description: sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugs.debian.org/946829#24; https://lists.debian.org/debian-lts-announce/2020/01/msg00006.html; https://marc.info/?l=spamassassin-users&m=[PII_REDACTED]5768&w=2
CVE: CVE-2019-19922
Published: 2019-12-22
Description: kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de53fd7aedb100f03e5d2231cfce0e[PII_REDACTED]; https://github.com/kubernetes/kubernetes/issues/67577
CVE: CVE-2019-19926
Published: 2019-12-23
Description: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
CVE: CVE-2019-19929
Published: 2019-12-23
Description: An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded by the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://borncity.com/win/2019/12/19/adwcleaner-8-0-1-closes-a-dll-hijacking-vulnerability/; https://forums.malwarebytes.com/topic/254898-release-adwcleaner-801/; https://www.bleepingcomputer.com/news/software/adwcleaner-801-fixes-dll-hijacking-vulnerability/
CVE: CVE-2019-11044
Published: 2019-12-23
Description: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
CVSS Score: 3.7 (LOW)
CWE: CWE-170
References: https://bugs.php.net/bug.php?id=78862; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/
CVE: CVE-2019-11045
Published: 2019-12-23
Description: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
CVSS Score: 3.7 (LOW)
CWE: CWE-170, CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html; https://bugs.php.net/bug.php?id=78863; https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html
CVE: CVE-2019-11046
Published: 2019-12-23
Description: In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html; https://bugs.php.net/bug.php?id=78878; https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html
CVE: CVE-2019-11047
Published: 2019-12-23
Description: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html; https://bugs.php.net/bug.php?id=78910; https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html