deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1656
Published: 2019-01-24
Description: A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An attacker could exploit this vulnerability by sending crafted commands to the affected device. An exploit could allow the attacker to gain shell access with a nonroot user account to the underlying Linux operating system on the affected device and potentially access system configuration files with sensitive information. This vulnerability only affects console connections from CIMC. It does not apply to remote connections, such as telnet or SSH.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/106715; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-nfvis-shell-access; http://www.securityfocus.com/bid/106715
CVE: CVE-2019-1657
Published: 2019-01-24
Description: A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to unsafe creation of API keys. An attacker could exploit this vulnerability by using insecure credentials to gain unauthorized access to the affected device. An exploit could allow the attacker to gain unauthorized access to information by using the API key credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106711; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-threat-grid; http://www.securityfocus.com/bid/106711
CVE: CVE-2019-1658
Published: 2019-01-24
Description: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections in the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/106713; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-uic-csrf; http://www.securityfocus.com/bid/106713
CVE: CVE-2019-1668
Published: 2019-01-24
Description: A vulnerability in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting (XSS) attacks against a user of the web-based user interface of an affected system. This vulnerability is due to insufficient sanitization of user-supplied input delivered to the chat feed as part of an HTTP request. An attacker could exploit this vulnerability by persuading a user to follow a link to attacker-controlled content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106720; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-miner-chat-xss; http://www.securityfocus.com/bid/106720
CVE: CVE-2019-1669
Published: 2019-01-24
Description: A vulnerability in the data acquisition (DAQ) component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies or cause a denial of service (DoS) condition. The vulnerability exists because the affected software improperly manages system memory resources when inspecting traffic. An attacker could exploit this vulnerability by generating specific traffic patterns for the software to inspect. A successful exploit could allow the attacker to exhaust system memory resources used for traffic inspection. Depending on the configuration, the FTD Software could fail open and cease to inspect traffic or fail closed and result in a DoS condition. This vulnerability may require manual intervention to restore the software.
CVSS Score: 8.6 (HIGH)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/106721; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-firepowertds-bypass; http://www.securityfocus.com/bid/106721
CVE: CVE-2019-6779
Published: 2019-01-24
Description: Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/chshcms/cscms/issues/3; https://github.com/chshcms/cscms/issues/3
CVE: CVE-2018-18363
Published: 2019-01-24
Description: Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access.
CVSS Score: 6.2 (MEDIUM)
References: http://www.securityfocus.com/bid/106450; https://support.symantec.com/en_US/article.SYMSA1473.html; http://www.securityfocus.com/bid/106450
CVE: CVE-2018-5497
Published: 2019-01-24
Description: Clustered Data ONTAP versions prior to 9.1P16, 9.3P10 and 9.4P5 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-6780
Published: 2019-01-24
Description: The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/changeset/2016929/wise-chat/trunk/src/rendering/filters/post/WiseChatLinksPostFilter.php; https://wordpress.org/plugins/wise-chat/#developers; https://www.exploit-db.com/exploits/46247/
CVE: CVE-2018-12237
Published: 2019-01-24
Description: The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/106518; https://support.symantec.com/en_US/article.SYMSA1465.html; http://www.securityfocus.com/bid/106518
CVE: CVE-2018-18981
Published: 2019-01-24
Description: In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could lead to a partial or complete denial-of-service condition to the affected services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: http://www.securityfocus.com/bid/106279; https://ics-cert.us-cert.gov/advisories/ICSA-18-331-02; http://www.securityfocus.com/bid/106279
CVE: CVE-2018-16098
Published: 2019-01-24
Description: In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://support.lenovo.com/us/en/solutions/LEN-24573; https://support.lenovo.com/bg/en/product_security/len-24573; https://support.lenovo.com/us/en/solutions/LEN-24573
CVE: CVE-2019-6802
Published: 2019-01-25
Description: CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/pypiserver/pypiserver/issues/237; https://github.com/pypiserver/pypiserver/issues/237
CVE: CVE-2017-18359
Published: 2019-01-25
Description: PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by an abnormal server termination for "SELECT ST_AsX3D('LINESTRING EMPTY');" because empty geometries are mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.debian.org/debian-lts-announce/2019/01/msg00030.html; https://lists.debian.org/debian-lts-announce/2021/12/msg00020.html; https://trac.osgeo.org/postgis/changeset/15444
CVE: CVE-2019-6803
Published: 2019-01-25
Description: typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/typora/typora-issues/issues/2124; https://github.com/typora/typora-issues/issues/2124
CVE: CVE-2019-6804
Published: 2019-01-25
Description: An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.rundeck.com/docs/history/version-3.0.13.html; https://github.com/rundeck/rundeck/issues/4406; https://www.exploit-db.com/exploits/46251/
CVE: CVE-2019-6805
Published: 2019-01-25
Description: SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/0FuzzingQ/vuln/blob/master/s-cms; https://github.com/0FuzzingQ/vuln/blob/master/s-cms
CVE: CVE-2018-20743
Published: 2019-01-25
Description: murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00023.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00058.html
CVE: CVE-2019-6956
Published: 2019-01-25
Description: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. It is a buffer over-read in ps_mix_phase in libfaad/ps_dec.c.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/blob/master/faad/global-buffer-overflow%40ps_mix_phase.md; https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html
CVE: CVE-2018-16881
Published: 2019-01-25
Description: A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/errata/RHBA-2019:2501; https://access.redhat.com/errata/RHSA-2019:2110; https://access.redhat.com/errata/RHSA-2019:2437
CVE: CVE-2019-3819
Published: 2019-01-25
Description: A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-835, CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html; http://www.securityfocus.com/bid/106730; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3819
CVE: CVE-2018-19009
Published: 2019-01-25
Description: Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: http://www.securityfocus.com/bid/106529; https://ics-cert.us-cert.gov/advisories/ICSA-19-010-03; http://www.securityfocus.com/bid/106529
CVE: CVE-2018-19021
Published: 2019-01-25
Description: A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3.1, 14.3, R5.1, R6 and prior, which may allow an attacker to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307, CWE-307
References: http://www.securityfocus.com/bid/106522; https://ics-cert.us-cert.gov/advisories/ICSA-19-010-01; http://www.securityfocus.com/bid/106522
CVE: CVE-2018-19023
Published: 2019-01-25
Description: Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294, CWE-287
References: http://www.securityfocus.com/bid/106448; https://ics-cert.us-cert.gov/advisories/ICSA-19-003-03; http://www.securityfocus.com/bid/106448
CVE: CVE-2019-6966
Published: 2019-01-25
Description: An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAtom class in Core/Ap4ElstAtom.cpp has an attempted excessive memory allocation related to AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h, as demonstrated by mp42hls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/361; https://github.com/axiomatic-systems/Bento4/issues/361
CVE: CVE-2019-6798
Published: 2019-01-26
Description: An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/106727; https://www.phpmyadmin.net/security/PMASA-2019-2/; http://www.securityfocus.com/bid/106727
CVE: CVE-2019-6799
Published: 2019-01-26
Description: An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/106736; https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html; https://www.phpmyadmin.net/security/PMASA-2019-1/
CVE: CVE-2019-6976
Published: 2019-01-26
Description: libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/memory.c does not zero out allocated memory. This can result in leaking raw process memory contents through the output image.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-908
References: https://blog.silentsignal.eu/2019/04/18/drop-by-drop-bleeding-through-libvips/; https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a; https://github.com/libvips/libvips/releases/tag/v8.7.4
CVE: CVE-2019-6703
Published: 2019-01-27
Description: Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
CVSS Score: 9.8 (CRITICAL)
References: https://wpvulndb.com/vulnerabilities/9208; https://www.wordfence.com/blog/2019/01/wordpress-sites-compromised-via-zero-day-vulnerabilities-in-total-donations-plugin/; https://wpvulndb.com/vulnerabilities/9208
CVE: CVE-2019-6977
Published: 2019-01-27
Description: gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00031.html; http://packetstormsecurity.com/files/152459/PHP-7.2-imagecolormatch-Out-Of-Band-Heap-Write.html
CVE: CVE-2018-20744
Published: 2019-01-28
Description: The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-346
References: http://www.securityfocus.com/bid/106834; https://github.com/rs/cors/issues/55; https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf
CVE: CVE-2018-20745
Published: 2019-01-28
Description: Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-346
References: https://github.com/yiisoft/yii2/issues/16193; https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-chen.pdf; https://github.com/yiisoft/yii2/issues/16193
CVE: CVE-2019-6978
Published: 2019-01-28
Description: The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00031.html; https://access.redhat.com/errata/RHSA-2019:2722
CVE: CVE-2019-6979
Published: 2019-01-28
Description: An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JeremyCrookshank/IP_History_Logs/pull/1; https://www.exploit-db.com/exploits/46273/; https://github.com/JeremyCrookshank/IP_History_Logs/pull/1
CVE: CVE-2019-6982
Published: 2019-01-28
Description: An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Write and crash during the handling of certain PDF files that embed specifically crafted 3D content, because of the improper handling of a logic exception in the IFXASSERT function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6983
Published: 2019-01-28
Description: An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Integer Overflow and crash during the handling of certain PDF files that embed specifically crafted 3D content, because of a free of valid memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6984
Published: 2019-01-28
Description: An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter a Use-After-Free or Type Confusion and crash during handling of certain PDF files that embed specifically crafted 3D content, due to the use of a wild pointer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-843
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-6985
Published: 2019-01-28
Description: An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-of-Bounds Read in Indexing or a Heap Overflow and crash during handling of certain PDF files that embed specifically crafted 3D content, due to an array access violation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-16889
Published: 2019-01-28
Description: Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-20, CWE-200, CWE-312
References: http://www.securityfocus.com/bid/106528; https://access.redhat.com/errata/RHSA-2019:2538; https://access.redhat.com/errata/RHSA-2019:2541
CVE: CVE-2018-10910
Published: 2019-01-28
Description: A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910; https://usn.ubuntu.com/3856-1/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910
CVE: CVE-2019-3815
Published: 2019-01-28
Description: A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-401
References: http://www.securityfocus.com/bid/106632; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2019:0201
CVE: CVE-2019-6986
Published: 2019-01-28
Description: SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-400
References: http://packetstormsecurity.com/files/172838/VIVO-SPARQL-Injection.html; https://github.com/kevinbackhouse/SecurityExploits/tree/0ec74459ac53685a7959ed58d580ef8abece3685/vivo-project; https://github.com/vivo-project/Vitro/pull/111
CVE: CVE-2019-6988
Published: 2019-01-28
Description: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: http://www.securityfocus.com/bid/106785; https://github.com/uclouvain/openjpeg/issues/1178; http://www.securityfocus.com/bid/106785