deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-8755
Published: 2019-12-18
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to determine kernel memory layout.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://support.apple.com/HT210634; https://support.apple.com/HT210634
CVE: CVE-2019-8757
Published: 2019-12-18
Description: A race condition existed when reading and writing user preferences. This was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15. The "Share Mac Analytics" setting may not be disabled when a user deselects the switch to share analytics.
CVSS Score: 2.5 (LOW)
CWE: CWE-362
References: https://support.apple.com/HT210634; https://support.apple.com/HT210634
CVE: CVE-2019-8758
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210634; https://support.apple.com/HT210634
CVE: CVE-2019-8760
Published: 2019-12-18
Description: This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/HT210606; https://support.apple.com/HT210606
CVE: CVE-2019-8763
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210635; https://support.apple.com/HT210636
CVE: CVE-2019-8764
Published: 2019-12-18
Description: A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210724; https://security.gentoo.org/glsa/202003-22
CVE: CVE-2019-8765
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210724; https://security.gentoo.org/glsa/202003-22
CVE: CVE-2019-8766
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210724; https://support.apple.com/HT210727
CVE: CVE-2019-8768
Published: 2019-12-18
Description: "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history items.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210634; https://security.gentoo.org/glsa/202003-22
CVE: CVE-2019-8769
Published: 2019-12-18
Description: An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history.
CVSS Score: 4.3 (MEDIUM)
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210634; https://security.gentoo.org/glsa/202003-22
CVE: CVE-2019-8770
Published: 2019-12-18
Description: The issue was addressed with improved permissions logic. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to access recent documents.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT210634; https://support.apple.com/HT210634
CVE: CVE-2019-8772
Published: 2019-12-18
Description: An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt. This issue is fixed in macOS Catalina 10.15. An attacker may be able to exfiltrate the contents of an encrypted PDF.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT210634; https://support.apple.com/kb/HT210722; https://support.apple.com/HT210634
CVE: CVE-2019-8775
Published: 2019-12-18
Description: The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13.1 and iPadOS 13.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/HT210603; https://support.apple.com/HT210724; https://support.apple.com/HT210603
CVE: CVE-2019-8779
Published: 2019-12-18
Description: A logic issue applied the incorrect restrictions. This issue was addressed by updating the logic to apply the correct restrictions. This issue is fixed in iOS 13.1.1 and iPadOS 13.1.1. Third party app extensions may not receive the correct sandbox restrictions.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-668
References: https://support.apple.com/HT210624; https://support.apple.com/HT210624
CVE: CVE-2019-8781
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210634; https://support.apple.com/HT210634
CVE: CVE-2019-8782
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8783
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8784
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210726
CVE: CVE-2019-8785
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8786
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8787
Published: 2019-12-18
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A remote attacker may be able to leak memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8788
Published: 2019-12-18
Description: An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Improper URL processing may lead to data exfiltration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210721
CVE: CVE-2019-8789
Published: 2019-12-18
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Parsing a maliciously crafted iBooks file may lead to disclosure of user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210721
CVE: CVE-2019-8791
Published: 2019-12-18
Description: An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://support.apple.com/HT210744; https://support.apple.com/HT210745; https://support.apple.com/HT210744
CVE: CVE-2019-8792
Published: 2019-12-18
Description: An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://support.apple.com/HT210744; https://support.apple.com/HT210745; https://support.apple.com/HT210744
CVE: CVE-2019-8793
Published: 2019-12-18
Description: A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2. A local user may be able to record the screen without a visible screen recording indicator.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT210721; https://support.apple.com/HT210721
CVE: CVE-2019-8794
Published: 2019-12-18
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8795
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210723; https://support.apple.com/HT210721
CVE: CVE-2019-8797
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8798
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8800
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210729; https://support.apple.com/HT210729
CVE: CVE-2019-8801
Published: 2019-12-18
Description: A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching. This issue is fixed in macOS Catalina 10.15.1, iTunes for Windows 12.10.2. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://support.apple.com/HT210722; https://support.apple.com/HT210726; https://support.apple.com/HT210722
CVE: CVE-2019-8802
Published: 2019-12-18
Description: A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15.1. A malicious application may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT210722; https://support.apple.com/HT210722
CVE: CVE-2019-8803
Published: 2019-12-18
Description: An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials..
CVSS Score: 8.4 (HIGH)
CWE: CWE-613
References: https://support.apple.com/HT210721; https://support.apple.com/HT210722; https://support.apple.com/HT210723
CVE: CVE-2019-8804
Published: 2019-12-18
Description: An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/HT210721; https://support.apple.com/HT210721
CVE: CVE-2019-8805
Published: 2019-12-18
Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Catalina 10.15.1. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/HT210722; https://support.apple.com/HT210722
CVE: CVE-2019-8806
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210729; https://support.apple.com/HT210729
CVE: CVE-2019-8807
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210722; https://support.apple.com/HT210722
CVE: CVE-2019-8808
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8811
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8812
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8813
Published: 2019-12-18
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8814
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8815
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8816
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8817
Published: 2019-12-18
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.1. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT210722; https://support.apple.com/HT210722
CVE: CVE-2019-8819
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8820
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8821
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8822
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8823
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202003-22; https://support.apple.com/HT210721; https://support.apple.com/HT210723
CVE: CVE-2019-8849
Published: 2019-12-18
Description: The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/HT210772; https://support.apple.com/HT210772
CVE: CVE-2012-2656
Published: 2019-12-18
Description: An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2012/05/29/11; http://www.openwall.com/lists/oss-security/2012/05/29/9; https://access.redhat.com/security/cve/cve-2012-2656
CVE: CVE-2019-19844
Published: 2019-12-18
Description: Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html; https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0