deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14443
Published: 2019-07-30
Description: An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.libav.org/show_bug.cgi?id=1161#c1; https://lists.debian.org/debian-lts-announce/2019/12/msg00003.html; https://bugzilla.libav.org/show_bug.cgi?id=1161#c1
CVE: CVE-2019-14444
Published: 2019-07-30
Description: apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html; https://security.gentoo.org/glsa/202007-39
CVE: CVE-2018-20867
Published: 2019-07-30
Description: cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2019-11775
Published: 2019-07-30
Description: All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems.
CVSS Score: 7.4 (HIGH)
CWE: CWE-367, CWE-367
References: https://access.redhat.com/errata/RHSA-2019:2494; https://access.redhat.com/errata/RHSA-2019:2495; https://access.redhat.com/errata/RHSA-2019:2585
CVE: CVE-2019-14392
Published: 2019-07-30
Description: cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-4062
Published: 2019-07-30
Description: IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 157007.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=ibm10881746; https://exchange.xforce.ibmcloud.com/vulnerabilities/157007; http://www.ibm.com/support/docview.wss?uid=ibm10881746
CVE: CVE-2019-4285
Published: 2019-07-30
Description: IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch other client-side browser attacks. IBM X-Force ID: 160513.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/160513; https://www.ibm.com/support/docview.wss?uid=ibm10884064; https://exchange.xforce.ibmcloud.com/vulnerabilities/160513
CVE: CVE-2019-4456
Published: 2019-07-30
Description: IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 163620.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163620; https://www.ibm.com/support/docview.wss?uid=ibm10959177; https://exchange.xforce.ibmcloud.com/vulnerabilities/163620
CVE: CVE-2018-20862
Published: 2019-07-30
Description: cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
CVSS Score: 7.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20863
Published: 2019-07-30
Description: cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20864
Published: 2019-07-30
Description: cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20865
Published: 2019-07-30
Description: cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20866
Published: 2019-07-30
Description: cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20868
Published: 2019-07-30
Description: cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20869
Published: 2019-07-30
Description: cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2018-20870
Published: 2019-07-30
Description: The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://documentation.cpanel.net/display/CL/76+Change+Log; https://documentation.cpanel.net/display/CL/76+Change+Log
CVE: CVE-2019-14393
Published: 2019-07-30
Description: cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
CVSS Score: 5.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14394
Published: 2019-07-30
Description: cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
CVSS Score: 5.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14395
Published: 2019-07-30
Description: cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14396
Published: 2019-07-30
Description: API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
CVSS Score: 3.3 (LOW)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14397
Published: 2019-07-30
Description: cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
CVSS Score: 5.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14398
Published: 2019-07-30
Description: cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/80+Change+Log; https://documentation.cpanel.net/display/CL/80+Change+Log
CVE: CVE-2019-14399
Published: 2019-07-30
Description: The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
CVSS Score: 7.1 (HIGH)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14400
Published: 2019-07-30
Description: cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
CVSS Score: 7.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14401
Published: 2019-07-30
Description: cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14402
Published: 2019-07-30
Description: cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
CVSS Score: 3.3 (LOW)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14403
Published: 2019-07-30
Description: cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14404
Published: 2019-07-30
Description: cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
CVSS Score: 5.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14405
Published: 2019-07-30
Description: cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14406
Published: 2019-07-30
Description: cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14407
Published: 2019-07-30
Description: cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
CVSS Score: 2.7 (LOW)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14408
Published: 2019-07-30
Description: cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
CVSS Score: 4.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14409
Published: 2019-07-30
Description: cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
CVSS Score: 5.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14410
Published: 2019-07-30
Description: Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
CVSS Score: 3.3 (LOW)
CWE: CWE-134
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14411
Published: 2019-07-30
Description: cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
CVSS Score: 5.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14412
Published: 2019-07-30
Description: Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
CVSS Score: 3.3 (LOW)
CWE: CWE-134
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14413
Published: 2019-07-30
Description: cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
CVSS Score: 4.3 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2019-14414
Published: 2019-07-30
Description: In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
CVSS Score: 3.3 (LOW)
References: https://documentation.cpanel.net/display/CL/78+Change+Log; https://documentation.cpanel.net/display/CL/78+Change+Log
CVE: CVE-2018-16871
Published: 2019-07-30
Description: A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2696; https://access.redhat.com/errata/RHSA-2019:2730; https://access.redhat.com/errata/RHSA-2020:0740
CVE: CVE-2019-10129
Published: 2019-07-30
Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10129; https://security.gentoo.org/glsa/202003-03; https://www.postgresql.org/about/news/1939/
CVE: CVE-2019-10130
Published: 2019-07-30
Description: A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-284
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130; https://security.gentoo.org/glsa/202003-03
CVE: CVE-2019-10138
Published: 2019-07-30
Description: A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138; https://review.opendev.org/#/c/631240/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
CVE: CVE-2019-10141
Published: 2019-07-30
Description: A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://access.redhat.com/errata/RHSA-2019:2505; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141; https://docs.openstack.org/releasenotes/ironic-inspector/ocata.html#relnotes-5-0-2-7-origin-stable-ocata
CVE: CVE-2019-10142
Published: 2019-07-30
Description: A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119, CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10142; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10142
CVE: CVE-2019-11202
Published: 2019-07-30
Description: An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://forums.rancher.com/c/announcements; https://rancher.com/docs/rancher/v2.x/en/security/; https://forums.rancher.com/c/announcements
CVE: CVE-2019-14318
Published: 2019-07-30
Description: Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because scalar multiplication in ecp.cpp (prime field curves, small leakage) and algebra.cpp (binary field curves, large leakage) is not constant time and leaks the bit length of the scalar among other information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-417
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00066.html; http://www.openwall.com/lists/oss-security/2019/10/02/2; https://eprint.iacr.org/2011/232.pdf
CVE: CVE-2019-1552
Published: 2019-07-30
Description: OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
CVSS Score: 3.3 (LOW)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=54aa9d51b09d67e90db443f682cface795f5af9e; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b15a19c148384e73338aa7c5b12652138e35ed28
CVE: CVE-2019-14242
Published: 2019-07-30
Description: An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bitdefender Internet Security, and Bitdefender Total Security versions prior to 23.0.24.120) that can lead to local code injection. A local attacker with administrator privileges can create a malicious DLL file in %SystemRoot%\System32\ that will be executed with local user privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.bitdefender.com/support/security-advisories/code-injection-bitdefender-products-windows/; https://www.bitdefender.com/support/security-advisories/code-injection-bitdefender-products-windows/
CVE: CVE-2019-14313
Published: 2019-07-30
Description: A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-101; https://plugins.trac.wordpress.org/changeset/2128378; https://wordpress.org/plugins/photo-gallery/#developers
CVE: CVE-2017-18381
Published: 2019-07-30
Description: The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
CVSS Score: 7.2 (HIGH)
References: https://groups.google.com/forum/#%21topic/openedx-announce/jRXyo1HJzNk; https://groups.google.com/forum/#%21topic/openedx-announce/mpyyx34LWSY; https://groups.google.com/forum/#%21topic/openedx-announce/jRXyo1HJzNk
CVE: CVE-2018-20859
Published: 2019-07-30
Description: edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/edx/edx-platform/commit/5b144559fbdba7ff673cc1c165aa2d343e07b6bd.patch; https://groups.google.com/forum/#%21topic/openedx-announce/wsm5mtUhhME; https://patch-diff.githubusercontent.com/raw/edx/edx-platform/pull/18639.patch
CVE: CVE-2018-20860
Published: 2019-07-30
Description: libopenmpt before 0.3.13 allows a crash with malformed MED files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00084.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00085.html; https://lib.openmpt.org/libopenmpt/2018/10/21/security-updates-0.3.13-0.2.10933-beta36-0.2.7561-beta20.5-p11-0.2.7386-beta20.3-p14/