deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-14880
Published: 2019-10-03
Description: The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-14881
Published: 2019-10-03
Description: The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-14882
Published: 2019-10-03
Description: The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16227
Published: 2019-10-03
Description: The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16228
Published: 2019-10-03
Description: The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16229
Published: 2019-10-03
Description: The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16230
Published: 2019-10-03
Description: The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16300
Published: 2019-10-03
Description: The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16301
Published: 2019-10-03
Description: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787, CWE-120
References: https://github.com/the-tcpdump-group/tcpdump/commit/ad7c25bc0decf96dc7768c9e903734d38528b1bd; https://github.com/the-tcpdump-group/tcpdump/commit/ad7c25bc0decf96dc7768c9e903734d38528b1bd
CVE: CVE-2018-16451
Published: 2019-10-03
Description: The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2018-16452
Published: 2019-10-03
Description: The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2019-15166
Published: 2019-10-03
Description: lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.
CVSS Score: 1.6 (LOW)
CWE: CWE-120, CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2019-15161
Published: 2019-10-03
Description: rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data at the end of a request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-131
References: http://seclists.org/fulldisclosure/2019/Dec/26; https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES; https://github.com/the-tcpdump-group/libpcap/commit/617b12c0339db4891d117b661982126c495439ea
CVE: CVE-2019-15162
Published: 2019-10-03
Description: rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: http://seclists.org/fulldisclosure/2019/Dec/26; https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES; https://github.com/the-tcpdump-group/libpcap/commit/484d60cbf7ca4ec758c3cbb8a82d68b244a78d58
CVE: CVE-2019-15163
Published: 2019-10-03
Description: rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://seclists.org/fulldisclosure/2019/Dec/26; https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES; https://github.com/the-tcpdump-group/libpcap/commit/437b273761adedcbd880f714bfa44afeec186a31
CVE: CVE-2019-15164
Published: 2019-10-03
Description: rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: http://seclists.org/fulldisclosure/2019/Dec/26; https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES; https://github.com/the-tcpdump-group/libpcap/commit/33834cb2a4d035b52aa2a26742f832a112e90a0a
CVE: CVE-2019-15165
Published: 2019-10-03
Description: sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00052.html; http://seclists.org/fulldisclosure/2019/Dec/26
CVE: CVE-2019-16866
Published: 2019-10-03
Description: Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-908
References: https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/
CVE: CVE-2019-16931
Published: 2019-10-03
Description: A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf; https://wordpress.org/plugins/visualizer/#developers; https://wpvulndb.com/vulnerabilities/9893
CVE: CVE-2019-16328
Published: 2019-10-03
Description: In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00004.html; https://github.com/tomerfiliba/rpyc
CVE: CVE-2019-17110
Published: 2019-10-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-10223. Reason: This candidate is a duplicate of CVE-2019-10223. Notes: All CVE users should reference CVE-2019-10223 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-15766
Published: 2019-10-03
Description: The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_text parameter set to the content of the file to be created). This can be a PHP file that is written to in the public web directory and subsequently executed. The attacker must have network connectivity to the PHP server that is running on the Android device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://play.google.com/store/apps/details?id=ru.kslabs.ksweb&gl=GB; https://rastating.github.io/ksweb-android-remote-code-execution/; https://play.google.com/store/apps/details?id=ru.kslabs.ksweb&gl=GB
CVE: CVE-2019-16198
Published: 2019-10-03
Description: KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://rastating.github.io/ksweb-android-remote-code-execution/; https://rastating.github.io/ksweb-android-remote-code-execution/
CVE: CVE-2019-11932
Published: 2019-10-03
Description: A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415, CWE-415
References: http://packetstormsecurity.com/files/154867/Whatsapp-2.19.216-Remote-Code-Execution.html; http://packetstormsecurity.com/files/158306/WhatsApp-android-gif-drawable-Double-Free.html; http://seclists.org/fulldisclosure/2019/Nov/27
CVE: CVE-2019-13323
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8783.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-840/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13324
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIFF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8782.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-841/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13325
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8922.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-842/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13326
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8864.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-849/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13327
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8888.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-850/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13328
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8913.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-851/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13329
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8695.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-852/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13330
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8742.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-853/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13331
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8838.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-854/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-13332
Published: 2019-10-03
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of templates in XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9149.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-19-855/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-17113
Published: 2019-10-04
Description: In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00044.html; https://github.com/OpenMPT/openmpt/commit/927688ddab43c2b203569de79407a899e734fabe
CVE: CVE-2019-17121
Published: 2019-10-04
Description: REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
CVE: CVE-2019-17130
Published: 2019-10-04
Description: vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423391-vbulletin-5-5-5-alpha-4-available-for-download; https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423391-vbulletin-5-5-5-alpha-4-available-for-download
CVE: CVE-2019-17131
Published: 2019-10-04
Description: vBulletin before 5.5.4 allows clickjacking.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4421373-vbulletin-connect-5-5-4-is-now-available-for-download; https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4421373-vbulletin-connect-5-5-4-is-now-available-for-download
CVE: CVE-2019-17132
Published: 2019-10-04
Description: vBulletin through 5.5.4 mishandles custom avatars.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-94
References: http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2019/Oct/9; https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2
CVE: CVE-2019-17133
Published: 2019-10-04
Description: In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2018-11768
Published: 2019-10-04
Description: In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://lists.apache.org/thread.html/2067a797b330530a6932f4b08f703b3173253d0a2b7c8c524e54adaf%40%3Cgeneral.hadoop.apache.org%3E; https://lists.apache.org/thread.html/2c9cc65864be0058a5d5ed2025dfb9c700bf23d352b0c826c36ff96a%40%3Chdfs-dev.hadoop.apache.org%3E; https://lists.apache.org/thread.html/72ca514e01cd5f08151e74f9929799b4cbe1b6e9e6cd24faa72ffcc6%40%3Cdev.lucene.apache.org%3E
CVE: CVE-2019-16891
Published: 2019-10-04
Description: Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from; https://sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4/; https://www.liferay.com/downloads-community