deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19547
Published: 2020-01-13
Description: Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRQXCOVFWZIIMAZIAAFAVQGZOS7LGHXP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQTOWEDFXDTGTD6D4NHRB4FUURQSTTEN/; https://support.symantec.com/us/en/article.SYMSA1502.html
CVE: CVE-2019-18893
Published: 2020-01-13
Description: XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/; https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
CVE: CVE-2019-18894
Published: 2020-01-13
Description: In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/; https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
CVE: CVE-2020-6859
Published: 2020-01-13
Description: Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L269; https://github.com/ultimatemember/ultimatemember/blob/627bbb0fae81ac34c60b43f0867eadcf8e1bc523/includes/core/class-files.php#L310; https://github.com/ultimatemember/ultimatemember/commit/[PII_REDACTED]12734a4f7d71f52609b2f301ea55b1
CVE: CVE-2019-19891
Published: 2020-01-13
Description: An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful exploit may allow the attacker to intercept sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-19-0009; https://www.mitel.com/support/security-advisories
CVE: CVE-2019-20209
Published: 2020-01-13
Description: The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-639
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-20210
Published: 2020-01-13
Description: The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-20211
Published: 2020-01-13
Description: The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2019-20212
Published: 2020-01-13
Description: The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-5195
Published: 2020-01-13
Description: Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.cerberusftp.com/hc/en-us/community/topics/[PII_REDACTED]99-Announcements; https://www.cerberusftp.com/xss-vulnerability-in-public-shares-fixed-in-cerberus-ftp-server-version-11-0-1-and-10-0-17/; https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities
CVE: CVE-2012-4767
Published: 2020-01-13
Description: An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a malicious user decrypt and potentially change the Safend security policies applied to the machine.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/56740; https://packetstormsecurity.com/files/118491/Safend-Data-Protector-3.4.5586.9772-Privilege-Escalation.html; https://www.securityfocus.com/archive/1/524864
CVE: CVE-2019-19727
Published: 2020-01-13
Description: SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html; https://bugzilla.suse.com/show_bug.cgi?id=1155784; https://lists.schedmd.com/pipermail/slurm-announce/
CVE: CVE-2019-19728
Published: 2020-01-13
Description: SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html; https://bugzilla.suse.com/show_bug.cgi?id=1159692; https://lists.schedmd.com/pipermail/slurm-announce/
CVE: CVE-2020-5390
Published: 2020-01-13
Description: PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/IdentityPython/pysaml2/commit/5e9d5acbcd8ae45c4e736ac521fd2df5b1c62e25; https://github.com/IdentityPython/pysaml2/commit/f27c7e7a7010f83380566a219fd6a290a00f2b6e; https://github.com/IdentityPython/pysaml2/releases
CVE: CVE-2020-6948
Published: 2020-01-13
Description: A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/HashBrownCMS/hashbrown-cms/issues/326; https://github.com/HashBrownCMS/hashbrown-cms/issues/326
CVE: CVE-2020-6949
Published: 2020-01-13
Description: A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/HashBrownCMS/hashbrown-cms/issues/327; https://github.com/HashBrownCMS/hashbrown-cms/issues/327
CVE: CVE-2012-4750
Published: 2020-01-13
Description: A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remote malicious user execute arbitrary code or cause a Denial of Service
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/79267; https://packetstormsecurity.com/files/117391/Ezhometech-EzServer-7.0-Remote-Heap-Corruption.html; https://www.securityfocus.com/archive/1/524430
CVE: CVE-2012-4760
Published: 2020-01-13
Description: A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/56740; https://packetstormsecurity.com/files/cve/CVE-2012-4760; https://seclists.org/bugtraq/2012/Nov/108
CVE: CVE-2012-4761
Published: 2020-01-13
Description: A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://www.securityfocus.com/bid/56740; https://packetstormsecurity.com/files/cve/CVE-2012-4760; https://seclists.org/bugtraq/2012/Nov/108
CVE: CVE-2019-20145
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-20146
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-20147
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-20148
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-5197
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-6832
Published: 2020-01-13
Description: An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues from private projects.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-19680
Published: 2020-01-13
Description: A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respectively, allows attackers to bypass protection mechanisms (related to extensions, MIME types, virus detection, and journal entries for transmitted files) by sending malformed (not RFC compliant) multipart email.
CVSS Score: 8.8 (HIGH)
References: https://www.proofpoint.com/us/security/cve-2019-19680; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2020-0001; https://www.proofpoint.com/us/security/cve-2019-19680
CVE: CVE-2019-20142
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-20143
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2019-20144
Published: 2020-01-13
Description: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/01/02/security-release-gitlab-12-6-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-6954
Published: 2020-01-13
Description: An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a media_folder.cgi?apply_mode=ping_server URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://nileshsapariya.blogspot.com/2020/01/cayin-smp-pro4-signage-media-player.html; https://nileshsapariya.blogspot.com/2020/01/cayin-smp-pro4-signage-media-player.html
CVE: CVE-2020-6955
Published: 2020-01-13
Description: An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://nileshsapariya.blogspot.com/2020/01/cayin-smp-pro4-signage-media-player.html; https://nileshsapariya.blogspot.com/2020/01/cayin-smp-pro4-signage-media-player.html
CVE: CVE-2020-6958
Published: 2020-01-14
Description: An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from remote hosts and potentially cause denial-of-service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/NationalSecurityAgency/ghidra/issues/943; https://github.com/purpleracc00n/Exploits-and-PoC/blob/master/XXE%20in%20YAJSW%E2%80%99s%20JnlpSupport%20affects%20Ghidra%20Server.md; https://sourceforge.net/p/yajsw/bugs/166/
CVE: CVE-2014-9211
Published: 2020-01-14
Description: ClickDesk version 4.3 and below has persistent cross site scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/65971; https://packetstormsecurity.com/files/author/11084/; http://www.securityfocus.com/bid/65971
CVE: CVE-2020-5194
Published: 2020-01-14
Description: The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endpoint. Improper permission verification occurs when calling the file/ajax_download_zip/zip_name endpoint. The result is that a user without permissions can zip and download files even if they do not have permission to view whether the file exists.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://support.cerberusftp.com/hc/en-us/community/topics/[PII_REDACTED]99-Announcements; https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities; https://support.cerberusftp.com/hc/en-us/community/topics/[PII_REDACTED]99-Announcements
CVE: CVE-2020-5196
Published: 2020-01-14
Description: Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list directories, and list files without the permission to zip and download (or unzip and upload) files. There are multiple ways to bypass certain permissions by utilizing the zip and unzip features. As a result, users without permission can see files, folders, and hidden files, and can create directories without permission.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276
References: https://support.cerberusftp.com/hc/en-us/community/topics/[PII_REDACTED]99-Announcements; https://www.cerberusftp.com/zip-unzip-permission-bypass-vulnerability-fixed-in-cerberus-ftp-server-versions-11-0-3-and-10-0-18/; https://www.doyler.net/security-not-included/cerberus-ftp-vulnerabilities
CVE: CVE-2013-2773
Published: 2020-01-14
Description: Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/58928; http://www.securityfocus.com/bid/58928
CVE: CVE-2013-7185
Published: 2020-01-14
Description: PotPlayer 1.5.40688: .avi File Memory Corruption
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/30413; https://exchange.xforce.ibmcloud.com/vulnerabilities/89981; http://www.exploit-db.com/exploits/30413
CVE: CVE-2019-0219
Published: 2020-01-14
Description: A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI.
CVSS Score: 9.8 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2019/11/28/1; https://lists.apache.org/thread.html/197482d5ab80c0bff4a5ec16e1b0466df38389d9a4b5331d777f14fc%40%3Cdev.cordova.apache.org%3E; https://lists.apache.org/thread/4vtg0trdrh5203dktt4f3vkd5z2d5ndj
CVE: CVE-2019-12399
Published: 2020-01-14
Description: When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2020/01/14/1; https://lists.apache.org/thread.html/r0e3a613705d70950aca2bfe9a6265c[PII_REDACTED]2d9a3dbce512ca9f%40%3Ccommits.druid.apache.org%3E; https://lists.apache.org/thread.html/r2d390dec5f360ec8aa294bef18e1a4385e2a3698d747209216f5a48b%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2014-4609
Published: 2020-01-14
Description: Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote attackers to execute arbitrary code via a crafted Literal Run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html; http://www.openwall.com/lists/oss-security/2014/06/26/22; https://libav.org/news/#2014-06-27
CVE: CVE-2014-4610
Published: 2020-01-14
Description: Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html; http://www.openwall.com/lists/oss-security/2014/06/26/23; https://www.ffmpeg.org/security.html
CVE: CVE-2014-5138
Published: 2020-01-14
Description: Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass parameter validation via unspecified vectors, possibly related to the Webpac Pro submodule.
CVSS Score: 7.5 (HIGH)
References: https://packetstormsecurity.com/files/128053/Sierra-Library-Services-Platform-1.2_3-XSS-Enumeration.html; https://packetstormsecurity.com/files/128053/Sierra-Library-Services-Platform-1.2_3-XSS-Enumeration.html
CVE: CVE-2014-5238
Published: 2020-01-14
Description: XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers to read arbitrary files and possibly other unspecified impact via a crafted OpenDocument Text document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: http://packetstormsecurity.com/files/128257/Open-Xchange-7.6.0-XSS-SSRF-Traversal.html; http://software.open-xchange.com/OX6/doc/Release_Notes_for_Patch_Release_2112_7.6.0_2014-08-25.pdf; http://www.securityfocus.com/archive/1/archive/1/533443/100/0/threaded
CVE: CVE-2015-8366
Published: 2020-01-14
Description: Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: http://packetstormsecurity.com/files/134573/LibRaw-0.17-Overflow.html; http://seclists.org/fulldisclosure/2015/Nov/108; http://www.libraw.org/news/libraw-0-17-1
CVE: CVE-2015-8367
Published: 2020-01-14
Description: The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: http://packetstormsecurity.com/files/134573/LibRaw-0.17-Overflow.html; http://seclists.org/fulldisclosure/2015/Nov/108; http://www.libraw.org/news/libraw-0-17-1
CVE: CVE-2020-5851
Published: 2020-01-14
Description: On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG
CVSS Score: 4.6 (MEDIUM)
References: https://support.f5.com/csp/article/K91171450; https://support.f5.com/csp/article/K91171450