deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13752
Published: 2019-12-10
Description: Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13753
Published: 2019-12-10
Description: Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13754
Published: 2019-12-10
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13755
Published: 2019-12-10
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13756
Published: 2019-12-10
Description: Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13757
Published: 2019-12-10
Description: Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13758
Published: 2019-12-10
Description: Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13759
Published: 2019-12-10
Description: Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13761
Published: 2019-12-10
Description: Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13762
Published: 2019-12-10
Description: Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.
CVSS Score: 3.3 (LOW)
CWE: CWE-667
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13763
Published: 2019-12-10
Description: Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-13764
Published: 2019-12-10
Description: Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html; https://access.redhat.com/errata/RHSA-2019:4238
CVE: CVE-2019-1332
Published: 2019-12-10
Description: A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-1332-Cross-Site%20Scripting-Microsoft%20SQL%20Server%20Reporting%20Services; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1332; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-1332-Cross-Site%20Scripting-Microsoft%20SQL%20Server%20Reporting%20Services
CVE: CVE-2019-1400
Published: 2019-12-10
Description: An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1463.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1400; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1400
CVE: CVE-2019-1453
Published: 2019-12-10
Description: A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1453; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1453
CVE: CVE-2019-1458
Published: 2019-12-10
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Local-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458
CVE: CVE-2019-1461
Published: 2019-12-10
Description: A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of Service Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1461; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1461
CVE: CVE-2019-1462
Published: 2019-12-10
Description: A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1462; https://www.zerodayinitiative.com/advisories/ZDI-19-1006/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1462
CVE: CVE-2019-1463
Published: 2019-12-10
Description: An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1463; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1463
CVE: CVE-2019-1464
Published: 2019-12-10
Description: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1464; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1464
CVE: CVE-2019-1465
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1466, CVE-2019-1467.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1465; https://www.zerodayinitiative.com/advisories/ZDI-19-1008/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1465
CVE: CVE-2019-1466
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1467.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1466; https://www.zerodayinitiative.com/advisories/ZDI-19-1007/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1466
CVE: CVE-2019-1467
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1466.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1467; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1467
CVE: CVE-2019-1468
Published: 2019-12-10
Description: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1468; https://www.zerodayinitiative.com/advisories/ZDI-19-1004/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1468
CVE: CVE-2019-1469
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1469; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1469
CVE: CVE-2019-1470
Published: 2019-12-10
Description: An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20, CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1470; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1470
CVE: CVE-2019-1471
Published: 2019-12-10
Description: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1471; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1471
CVE: CVE-2019-1472
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1474.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1472; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1472
CVE: CVE-2019-1474
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1472.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1474; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1474
CVE: CVE-2019-1476
Published: 2019-12-10
Description: An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1483.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/155653/AppXSvc-17763-Arbitrary-File-Overwrite.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1476; http://packetstormsecurity.com/files/155653/AppXSvc-17763-Arbitrary-File-Overwrite.html
CVE: CVE-2019-1477
Published: 2019-12-10
Description: An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Printer Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1477; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1477
CVE: CVE-2019-1478
Published: 2019-12-10
Description: An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1478; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1478
CVE: CVE-2019-1480
Published: 2019-12-10
Description: An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1481.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1480; https://www.zerodayinitiative.com/advisories/ZDI-19-1002/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1480
CVE: CVE-2019-1481
Published: 2019-12-10
Description: An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1480.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1481; https://www.zerodayinitiative.com/advisories/ZDI-19-1003/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1481
CVE: CVE-2019-1483
Published: 2019-12-10
Description: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1476.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1483; https://www.zerodayinitiative.com/advisories/ZDI-19-1005/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1483
CVE: CVE-2019-1484
Published: 2019-12-10
Description: A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1484; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1484
CVE: CVE-2019-1485
Published: 2019-12-10
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1485; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1485
CVE: CVE-2019-1486
Published: 2019-12-10
Description: A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1486; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1486
CVE: CVE-2019-1487
Published: 2019-12-10
Description: An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions, aka 'Microsoft Authentication Library for Android Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1487; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1487
CVE: CVE-2019-1488
Published: 2019-12-10
Description: A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender Security Feature Bypass Vulnerability'.
CVSS Score: 3.3 (LOW)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1488; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1488
CVE: CVE-2019-1489
Published: 2019-12-10
Description: An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information Disclosure Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1489; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1489
CVE: CVE-2019-1490
Published: 2019-12-10
Description: A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1490; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1490
CVE: CVE-2019-14861
Published: 2019-12-10
Description: All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html; http://www.openwall.com/lists/oss-security/2024/06/24/3; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14861
CVE: CVE-2019-14870
Published: 2019-12-10
Description: All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the not-delegated flag set.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00038.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14870; https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
CVE: CVE-2019-14889
Published: 2019-12-10
Description: A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889
CVE: CVE-2019-19604
Published: 2019-12-11
Description: Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; http://www.openwall.com/lists/oss-security/2019/12/13/1