deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13103
Published: 2019-07-29
Description: A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-674
References: https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf; https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75; https://github.com/u-boot/u-boot/commits/master
CVE: CVE-2015-5601
Published: 2019-07-29
Description: edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://open.edx.org/announcements/CVE-2015-5601; https://open.edx.org/announcements/CVE-2015-5601
CVE: CVE-2015-6253
Published: 2019-07-29
Description: edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://open.edx.org/CVE-2015-6253; https://open.edx.org/announcements/cve-2015-6253/; https://open.edx.org/CVE-2015-6253
CVE: CVE-2015-6960
Published: 2019-07-29
Description: edx-platform before 2015-09-17 allows XSS via a team name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://open.edx.org/announcements/cve-2015-6960/; https://open.edx.org/announcements/cve-2015-6960/
CVE: CVE-2015-9288
Published: 2019-07-29
Description: The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://blogs.unity3d.com/2015/06/06/security-update-coming-for-web-player/; https://blogs.unity3d.com/2015/06/06/security-update-coming-for-web-player/
CVE: CVE-2019-11199
Published: 2019-07-29
Description: Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities; https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities
CVE: CVE-2019-11200
Published: 2019-07-29
Description: Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
CVSS Score: 8.8 (HIGH)
References: https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities; https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities
CVE: CVE-2019-11201
Published: 2019-07-29
Description: Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities; https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities
CVE: CVE-2019-12743
Published: 2019-07-29
Description: HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/chanpu9/CVE/blob/master/2019-12743; https://humhub.org/en/news; https://github.com/chanpu9/CVE/blob/master/2019-12743
CVE: CVE-2019-12948
Published: 2019-07-29
Description: A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.
CVSS Score: 8.3 (HIGH)
CWE: CWE-749
References: https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf; https://support.polycom.com/content/dam/polycom-support/global/documentation/remote-code-execution-vulnerability-in-ucs-software-v1-1.pdf
CVE: CVE-2019-14267
Published: 2019-07-29
Description: PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/153767/pdfresurrect-0.15-Buffer-Overflow.html; https://github.com/enferex/pdfresurrect/commits/master; https://github.com/snappyJack/pdfresurrect_CVE-2019-14267
CVE: CVE-2019-6726
Published: 2019-07-29
Description: The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://packetstormsecurity.com/files/152042; https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/wpFastestCache.php; https://wordpress.org/plugins/wp-fastest-cache/
CVE: CVE-2016-10765
Published: 2019-07-29
Description: edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://open.edx.org/announcements/security-alert-account-activation-unverified-email/; https://open.edx.org/announcements/security-alert-account-activation-unverified-email/
CVE: CVE-2016-10766
Published: 2019-07-29
Description: edx-platform before 2016-06-06 allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/edx/edx-platform/commit/d54f79f5bf3e1af17063937df1abc[PII_REDACTED]d.patch; https://open.edx.org/announcements/cross-site-request-forgery-bug-edx-lms/; https://github.com/edx/edx-platform/commit/d54f79f5bf3e1af17063937df1abc[PII_REDACTED]d.patch
CVE: CVE-2019-11868
Published: 2019-07-29
Description: See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://downwithup.github.io/CVEPosts; https://github.com/SoftEtherVPN/SoftEtherVPN/tree/master/src/See; https://www.softether.org/9-about/News/900-SEVPN201901
CVE: CVE-2019-13126
Published: 2019-07-29
Description: An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/nats-io/nats-server/pull/1053; https://www.twistlock.com/labs-blog/finding-dos-vulnerability-nats-go-fuzz-cve-2019-13126/; https://github.com/nats-io/nats-server/pull/1053
CVE: CVE-2019-13498
Published: 2019-07-29
Description: One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319
References: https://github.com/FurqanKhan1/CVE-2019-13498; https://support.oneidentity.com/technical-documents/cloud-access-manager/8.1.4/release-notes#TOPIC-1028731; https://github.com/FurqanKhan1/CVE-2019-13498
CVE: CVE-2018-17211
Published: 2019-07-29
Description: An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17211-Unauthenticated_Information_Disclosure-PrinterOn; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17211-Unauthenticated_Information_Disclosure-PrinterOn
CVE: CVE-2018-17213
Published: 2019-07-29
Description: An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17213-Authentication_Bypass-PrinterOn; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2018-17213-Authentication_Bypass-PrinterOn
CVE: CVE-2019-13571
Published: 2019-07-29
Description: A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-093; https://github.com/beerpwn/ctf/blob/master/CVE/CVE-2019-13571/report.pdf; https://github.com/beerpwn/ctf/tree/master/CVE/CVE-2019-13571
CVE: CVE-2019-14271
Published: 2019-07-29
Description: In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html; https://docs.docker.com/engine/release-notes/; https://github.com/moby/moby/issues/39449
CVE: CVE-2018-11772
Published: 2019-07-29
Description: Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E; https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E
CVE: CVE-2018-11773
Published: 2019-07-29
Description: Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://lists.apache.org/thread.html/8f3284afbcb4b87ed107dac98603020c23a379c687858b41da763147%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/db71c4edc21ecb834cf20e3ee23ffac5d37f32e7eb67257a413bf878%40%3Cdev.vcl.apache.org%3E; https://lists.apache.org/thread.html/8f3284afbcb4b87ed107dac98603020c23a379c687858b41da763147%40%3Cannounce.apache.org%3E
CVE: CVE-2018-11774
Published: 2019-07-29
Description: Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread.html/14486ee999650f72c166812290b2d8f851d39266ca31b91b68aebcd6%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/8f90e00910d1ee3d850e56d87c18cb298a126d10955413d296e47c0c%40%3Cdev.vcl.apache.org%3E; https://lists.apache.org/thread.html/14486ee999650f72c166812290b2d8f851d39266ca31b91b68aebcd6%40%3Cannounce.apache.org%3E
CVE: CVE-2019-13655
Published: 2019-07-29
Description: Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of 64250x64250 pixels, which is mishandled during an attempt to load the 'whole image' into memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://obsidianterminal.blogspot.com/2019/07/dos-in-imgix-cdns-image-processing.html; https://obsidianterminal.blogspot.com/2019/07/dos-in-imgix-cdns-image-processing.html
CVE: CVE-2019-14415
Published: 2019-07-29
Description: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html; http://seclists.org/fulldisclosure/2019/Jul/39; https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue4
CVE: CVE-2019-14416
Published: 2019-07-29
Description: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html; http://seclists.org/fulldisclosure/2019/Jul/39; https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue3
CVE: CVE-2019-14417
Published: 2019-07-29
Description: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html; http://seclists.org/fulldisclosure/2019/Jul/39; https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue2
CVE: CVE-2019-14418
Published: 2019-07-29
Description: An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html; http://seclists.org/fulldisclosure/2019/Jul/39; https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1
CVE: CVE-2019-14431
Published: 2019-07-29
Description: In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755, CWE-787
References: https://github.com/matrixssl/matrixssl/issues/30; https://github.com/matrixssl/matrixssl/issues/30
CVE: CVE-2019-3948
Published: 2019-07-29
Description: The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2[PII_REDACTED].9.R, Dahua IPC HX5X3X and HX4X3X V2[PII_REDACTED].0.R, Dahua DH-IPC HX883X and DH-IPC-HX863X V2[PII_REDACTED].7.R, Dahua DH-SD4XXXXX V2[PII_REDACTED].7.R, Dahua DH-SD5XXXXX V2[PII_REDACTED].1.R, Dahua DH-SD6XXXXX V2[PII_REDACTED].2.R and V2[PII_REDACTED].1.R, Dahua NVR5XX-4KS2 V3[PII_REDACTED].0.R, Dahua NVR4XXX-4KS2 V3[PII_REDACTED].0.R, and NVR2XXX-4KS2 do not require authentication to access the HTTP endpoint /videotalk. An unauthenticated, remote person can connect to this endpoint and potentionally listen to the audio of the capturing device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://packetstormsecurity.com/files/153813/Amcrest-Cameras-2.520.AC00.18.R-Unauthenticated-Audio-Streaming.html; https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02.pdf; https://www.dahuasecurity.com/support/cybersecurity/details/627?us
CVE: CVE-2018-18570
Published: 2019-07-29
Description: Planon before Live Build 41 has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html; https://www2.deloitte.com/de/de/pages/risk/articles/planon-cross-site-scripting.html
CVE: CVE-2019-14439
Published: 2019-07-30
Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2019:3200; https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b; https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2
CVE: CVE-2015-9290
Published: 2019-07-30
Description: In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/type1/t1parse.c?id=e3058617f384cb6709f3878f753fa17aca9e3a30; https://lists.debian.org/debian-lts-announce/2019/08/msg00019.html; https://savannah.nongnu.org/bugs/?45923
CVE: CVE-2017-18380
Published: 2019-07-30
Description: edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/edx/edx-platform/pull/15773; https://groups.google.com/forum/#%21topic/openedx-announce/QTvijt48bAY; https://github.com/edx/edx-platform/pull/15773
CVE: CVE-2019-13635
Published: 2019-07-30
Description: The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153821/WordPress-WP-Fastest-Cache-0.8.9.5-Directory-Traversal.html; https://plugins.trac.wordpress.org/changeset/2124614; https://plugins.trac.wordpress.org/changeset/2124619
CVE: CVE-2019-14327
Published: 2019-07-30
Description: A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/custom-simple-rss/#developers; https://wpvulndb.com/vulnerabilities/9483; https://wordpress.org/plugins/custom-simple-rss/#developers
CVE: CVE-2019-14381
Published: 2019-07-30
Description: libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://lib.openmpt.org/libopenmpt/2019/02/11/security-update-0.4.3/; https://lib.openmpt.org/libopenmpt/2019/02/11/security-update-0.4.3/
CVE: CVE-2019-14386
Published: 2019-07-30
Description: cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14387
Published: 2019-07-30
Description: cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14388
Published: 2019-07-30
Description: cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
CVSS Score: 7.5 (HIGH)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14389
Published: 2019-07-30
Description: cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
CVSS Score: 7.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14390
Published: 2019-07-30
Description: cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14391
Published: 2019-07-30
Description: cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
CVSS Score: 3.3 (LOW)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-14441
Published: 2019-07-30
Description: An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv. This is related to ff_mpa_synth_filter_float in avcodec/mpegaudiodsp_template.c. NOTE: This may be a duplicate of CVE-2018-19129
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.libav.org/show_bug.cgi?id=1161#c0; https://bugzilla.libav.org/show_bug.cgi?id=1161#c0
CVE: CVE-2019-14442
Published: 2019-07-30
Description: In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://bugzilla.libav.org/show_bug.cgi?id=1159; https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html; https://bugzilla.libav.org/show_bug.cgi?id=1159