deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7994
Published: 2020-01-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tufangungor/tufangungor.github.io/blob/master/0days.md; https://tufangungor.github.io/0days; https://github.com/tufangungor/tufangungor.github.io/blob/master/0days.md
CVE: CVE-2020-7995
Published: 2020-01-26
Description: The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: http://packetstormsecurity.com/files/163541/Dolibarr-ERP-CRM-10.0.6-Login-Brute-Forcer.html; https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.md; https://tufangungor.github.io/exploit/2020/01/18/dolibarr-10.0.6-brute-force.html
CVE: CVE-2020-7996
Published: 2020-01-26
Description: htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-xss-in-http-header.md; https://tufangungor.github.io/exploit/2020/01/18/dolibarr-10.0.6-xss-in-http-header.html; https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-xss-in-http-header.md
CVE: CVE-2020-7999
Published: 2020-01-27
Description: The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html; https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html
CVE: CVE-2020-8000
Published: 2020-01-27
Description: Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html; https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html
CVE: CVE-2020-8001
Published: 2020-01-27
Description: The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html; https://sku11army.blogspot.com/2020/01/intellian-multiple-vulnerabilities-in.html
CVE: CVE-2019-20421
Published: 2020-01-27
Description: In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8; https://github.com/Exiv2/exiv2/issues/1011; https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html
CVE: CVE-2019-20422
Published: 2020-01-27
Description: In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.4; https://github.com/torvalds/linux/commit/7b09c2d052db4b4ad0b27b97918b46a7746966fa; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-20423
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by a client. The function target_handle_connect() mishandles a certain size value when a client connects to a server, because of an integer signedness error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12605
CVE: CVE-2019-20424
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of validation for specific fields of packets sent by a client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12615
CVE: CVE-2019-20425
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function lustre_msg_string, there is no validation of a certain length value derived from lustre_msg_buflen_v2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12613
CVE: CVE-2019-20426
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. In the function ldlm_cancel_hpreq_check, there is no lock_count bounds check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12614
CVE: CVE-2019-20427
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the lack of validation for specific fields of packets sent by a client. Interaction between req_capsule_get_size and tgt_brw_write leads to a tgt_shortio2pages integer signedness error.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12600
CVE: CVE-2019-20428
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fields of packets sent by a client. The ldl_request_cancel function mishandles a large lock_count parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12603
CVE: CVE-2019-20429
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufcount field) due to the lack of validation for specific fields of packets sent by a client. This is caused by interaction between sptlrpc_svc_unwrap_request and lustre_msg_hdr_size_v2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12590
CVE: CVE-2019-20430
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validation for specific fields of packets sent by a client.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-670
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12602
CVE: CVE-2019-20431
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. osd_bufs_get in the osd_ldiskfs module does not validate a certain length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12612
CVE: CVE-2019-20432
Published: 2020-01-27
Description: In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent by a client. mdt_file_secctx_unpack does not validate the value of name_size derived from req_capsule_get_size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lustre.org/; http://wiki.lustre.org/Lustre_2.12.3_Changelog; https://jira.whamcloud.com/browse/LU-12604
CVE: CVE-2020-8002
Published: 2020-01-27
Description: A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340; https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=572a[PII_REDACTED]8fa727f50313508be99865b58f; https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=725e12beba4a41934f0ab62d399b5d4de2d13190
CVE: CVE-2020-8003
Published: 2020-01-27
Description: A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://gitlab.freedesktop.org/virgl/virglrenderer/commit/f9b079ccc319c98499111f66bd654fc9b56cf15f?merge_request_iid=340; https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340; https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=3320973c9f2068f60cf6613c2811a[PII_REDACTED]a
CVE: CVE-2018-12476
Published: 2020-01-27
Description: Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2[PII_REDACTED].fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2[PII_REDACTED].fefaa74.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://bugzilla.suse.com/show_bug.cgi?id=1107944; https://bugzilla.suse.com/show_bug.cgi?id=1107944
CVE: CVE-2018-20105
Published: 2020-01-27
Description: A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00015.html; https://bugzilla.suse.com/show_bug.cgi?id=1119835
CVE: CVE-2017-14806
Published: 2020-01-27
Description: A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version 1.3.17-56.6.3 and prior versions.
CVSS Score: 3.7 (LOW)
CWE: CWE-295, CWE-295
References: https://bugzilla.suse.com/show_bug.cgi?id=1065397; https://bugzilla.suse.com/show_bug.cgi?id=1065397
CVE: CVE-2017-14807
Published: 2020-01-27
Description: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects: SUSE Studio onsite susestudio-ui-server version 1.3.17-56.6.3 and prior versions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.suse.com/show_bug.cgi?id=1065396; https://bugzilla.suse.com/show_bug.cgi?id=1065396
CVE: CVE-2019-6036
Published: 2020-01-27
Description: Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN97325754/index.html; https://f-revocrm.jp/2019/12/9393; http://jvn.jp/en/jp/JVN97325754/index.html
CVE: CVE-2020-5520
Published: 2020-01-27
Description: The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN66435380/index.html; https://www.printing.ne.jp/support/information/AppVulnerability.html; http://jvn.jp/en/jp/JVN66435380/index.html
CVE: CVE-2020-5521
Published: 2020-01-27
Description: The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN66435380/index.html; https://www.printing.ne.jp/support/information/AppVulnerability.html; http://jvn.jp/en/jp/JVN66435380/index.html
CVE: CVE-2020-5522
Published: 2020-01-27
Description: The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://jvn.jp/en/jp/JVN66435380/index.html; https://www.printing.ne.jp/support/information/AppVulnerability.html; http://jvn.jp/en/jp/JVN66435380/index.html
CVE: CVE-2017-16112
Published: 2020-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:CVE-2017-15010. Reason: This candidate is a reservation duplicate of CVE-2017-15010. Notes: All CVE users should reference CVE-2017-15010 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-17100
Published: 2020-01-27
Description: An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020-va-5895/; https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020-va-5895/
CVE: CVE-2019-17102
Published: 2020-01-27
Description: An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.
CVSS Score: 8.3 (HIGH)
CWE: CWE-413, CWE-367
References: https://www.bitdefender.com/support/security-advisories/bitdefender-box-v2-bootstrap-update_setup-command-execution-vulnerability-va-2226; https://www.bitdefender.com/support/security-advisories/bitdefender-box-v2-bootstrap-update_setup-command-execution-vulnerability-va-2226
CVE: CVE-2019-17103
Published: 2020-01-27
Description: An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.bitdefender.com/support/security-advisories/get-task-allow-entitlement-via-bdldaemon-macos-va-3448/; https://www.bitdefender.com/support/security-advisories/get-task-allow-entitlement-via-bdldaemon-macos-va-3448/
CVE: CVE-2020-8009
Published: 2020-01-27
Description: AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.securenetworkinc.com/news/2020/1/22/new-vulnerability-motu-avb-directory-traversal; https://www.securenetworkinc.com/news/2020/1/22/new-vulnerability-motu-avb-directory-traversal
CVE: CVE-2006-7246
Published: 2020-01-27
Description: NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2010/04/22/2; https://bugzilla.gnome.org/show_bug.cgi?id=341323; https://bugzilla.novell.com/show_bug.cgi?id=574266
CVE: CVE-2011-4558
Published: 2020-01-27
Description: Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://packetstormsecurity.com/files/108111/Tiki-Wiki-CMS-Groupware-8.2-Code-Injection.html; https://packetstormsecurity.com/files/108111/Tiki-Wiki-CMS-Groupware-8.2-Code-Injection.html
CVE: CVE-2012-1495
Published: 2020-01-27
Description: install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/; https://packetstormsecurity.com/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html; https://packetstormsecurity.com/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html
CVE: CVE-2012-1496
Published: 2020-01-27
Description: Local file inclusion in WebCalendar before 1.2.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/; http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.5/
CVE: CVE-2013-0286
Published: 2020-01-27
Description: Pinboard 1.0.6 theme for Wordpress has XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/02/14/4; http://www.openwall.com/lists/oss-security/2013/02/14/4
CVE: CVE-2013-3486
Published: 2020-01-27
Description: IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow Vulnerability
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/60232; https://exchange.xforce.ibmcloud.com/vulnerabilities/84903; http://www.securityfocus.com/bid/60232
CVE: CVE-2013-3492
Published: 2020-01-27
Description: XnView 2.03 has a stack-based buffer overflow vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/61503; http://www.securityfocus.com/bid/61503
CVE: CVE-2013-3493
Published: 2020-01-27
Description: XnView 2.03 has an integer overflow vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.securityfocus.com/bid/61505; http://www.securityfocus.com/bid/61505
CVE: CVE-2013-4462
Published: 2020-01-27
Description: WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2013/10/24/1; http://www.securityfocus.com/bid/63249; http://www.openwall.com/lists/oss-security/2013/10/24/1
CVE: CVE-2013-5659
Published: 2020-01-27
Description: Wiz 5.0.3 has a user mode write access violation
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://realpentesting.blogspot.com/p/realpentesting-advisory-title-user-mode.html; http://seclists.org/fulldisclosure/2013/Sep/8; http://realpentesting.blogspot.com/p/realpentesting-advisory-title-user-mode.html
CVE: CVE-2013-6056
Published: 2020-01-27
Description: OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.tenable.com/plugins/nessus/76122; https://www.tenable.com/plugins/nessus/76122
CVE: CVE-2014-4156
Published: 2020-01-27
Description: Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://www.openwall.com/lists/oss-security/2014/06/17/16; http://www.securityfocus.com/bid/68028; http://www.openwall.com/lists/oss-security/2014/06/17/16
CVE: CVE-2015-4709
Published: 2020-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-20433
Published: 2020-01-27
Description: libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://aspell.net/buffer-overread-ucs.txt; http://aspell.net/buffer-overread-ucs.txt
CVE: CVE-2014-8161
Published: 2020-01-27
Description: PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: http://www.debian.org/security/2015/dsa-3155; http://www.postgresql.org/about/news/1569/; http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
CVE: CVE-2014-9481
Published: 2020-01-27
Description: The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2014/12/21/2; http://www.openwall.com/lists/oss-security/2015/01/03/13; https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
CVE: CVE-2015-0241
Published: 2020-01-27
Description: The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://www.debian.org/security/2015/dsa-3155; http://www.postgresql.org/about/news/1569/; http://www.postgresql.org/docs/9.4/static/release-9-4-1.html