deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5849
Published: 2019-11-25
Description: Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html; https://crbug.com/954891; https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html
CVE: CVE-2019-5850
Published: 2019-11-25
Description: Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/977462; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5851
Published: 2019-11-25
Description: Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/977107; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5852
Published: 2019-11-25
Description: Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/976713; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5853
Published: 2019-11-25
Description: Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/976627; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5854
Published: 2019-11-25
Description: Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/966263; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5855
Published: 2019-11-25
Description: Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/964872; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5856
Published: 2019-11-25
Description: Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/964245; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5857
Published: 2019-11-25
Description: Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/961237; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5858
Published: 2019-11-25
Description: Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/960209; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5859
Published: 2019-11-25
Description: Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/959438; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5860
Published: 2019-11-25
Description: Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/956947; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5861
Published: 2019-11-25
Description: Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/951525; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5862
Published: 2019-11-25
Description: Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/946260; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5864
Published: 2019-11-25
Description: Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-863
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/936900; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5865
Published: 2019-11-25
Description: Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html; https://crbug.com/973103; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
CVE: CVE-2019-5866
Published: 2019-11-25
Description: Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop.html; https://crbug.com/978382; https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop.html
CVE: CVE-2019-5867
Published: 2019-11-25
Description: Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html; https://crbug.com/984344; https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html
CVE: CVE-2019-5868
Published: 2019-11-25
Description: Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html; https://crbug.com/983867; https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html
CVE: CVE-2019-5869
Published: 2019-11-25
Description: Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop_26.html; https://crbug.com/978793; https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop_26.html
CVE: CVE-2019-5870
Published: 2019-11-25
Description: Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/999311; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5871
Published: 2019-11-25
Description: Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/990570; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5872
Published: 2019-11-25
Description: Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/981492; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5873
Published: 2019-11-25
Description: Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/989497; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5874
Published: 2019-11-25
Description: Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/989797; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5875
Published: 2019-11-25
Description: Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/979443; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5876
Published: 2019-11-25
Description: Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/997190; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5877
Published: 2019-11-25
Description: Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/999310; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5878
Published: 2019-11-25
Description: Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/1000217; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5879
Published: 2019-11-25
Description: Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/986043; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5880
Published: 2019-11-25
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/831725; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2019-5881
Published: 2019-11-25
Description: Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html; https://crbug.com/980816; https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
CVE: CVE-2015-1396
Published: 2019-11-25
Description: A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2015/01/27/29; http://www.openwall.com/lists/oss-security/2015/01/27/29; http://www.securityfocus.com/bid/75358
CVE: CVE-2019-10217
Published: 2019-11-25
Description: A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10217
CVE: CVE-2019-10224
Published: 2019-11-25
Description: A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-522, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224; https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html; https://pagure.io/389-ds-base/issue/50251
CVE: CVE-2019-14825
Published: 2019-11-25
Description: A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
CVSS Score: 2.7 (LOW)
CWE: CWE-312, CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14825; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14825
CVE: CVE-2019-15684
Published: 2019-11-25
Description: Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions.
CVSS Score: 4.3 (MEDIUM)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1; https://www.symantec.com/security-center/vulnerabilities/writeup/110997; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE: CVE-2019-17406
Published: 2019-11-25
Description: Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.nokia.com/networks/solutions/impact-iot-platform/; https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html; https://www.nokia.com/networks/solutions/impact-iot-platform/
CVE: CVE-2013-4224
Published: 2019-11-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-4187. Reason: This candidate is a duplicate of CVE-2013-4187. Notes: All CVE users should reference CVE-2013-4187 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-2025
Published: 2019-11-25
Description: IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory that are read/writable by everyone. IBM X-Force ID: 155551.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/155551; https://www.ibm.com/support/pages/node/1107261; https://exchange.xforce.ibmcloud.com/vulnerabilities/155551
CVE: CVE-2019-16764
Published: 2019-11-25
Description: The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://erlang.org/doc/efficiency_guide/commoncaveats.html#list_to_atom-1; https://github.com/pow-auth/pow_assent/commit/026105eeecc0e3c2f807e7109e745ea93c0fd9cf; https://github.com/pow-auth/pow_assent/security/advisories/GHSA-368c-xvrv-x986
CVE: CVE-2019-18374
Published: 2019-11-25
Description: Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.symantec.com/us/en/article.SYMSA1498.html; https://support.symantec.com/us/en/article.SYMSA1498.html
CVE: CVE-2019-19246
Published: 2019-11-25
Description: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.php.net/bug.php?id=78559; https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b; https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html
CVE: CVE-2019-19249
Published: 2019-11-25
Description: Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/d4software/QueryTree/commit/57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f; https://github.com/d4software/QueryTree/compare/3.0.97-beta...3.0.99-beta; https://github.com/d4software/QueryTree/commit/57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f
CVE: CVE-2019-19250
Published: 2019-11-25
Description: OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/3s3s/opentrade/commit/a3eb3c645cfd1f3d310c10e4fb1f2f64a4d5e45e; https://github.com/3s3s/opentrade/commit/a3eb3c645cfd1f3d310c10e4fb1f2f64a4d5e45e
CVE: CVE-2019-4406
Published: 2019-11-25
Description: IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477.
CVSS Score: 4.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162477; https://www.ibm.com/support/pages/node/1107777; https://exchange.xforce.ibmcloud.com/vulnerabilities/162477
CVE: CVE-2011-4924
Published: 2019-11-25
Description: Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/01/19/16; http://www.openwall.com/lists/oss-security/2012/01/19/17; http://www.openwall.com/lists/oss-security/2012/01/19/18
CVE: CVE-2012-6639
Published: 2019-11-25
Description: An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://www.openwall.com/lists/oss-security/2014/03/06/7; https://access.redhat.com/security/cve/cve-2012-6639; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6639
CVE: CVE-2019-16765
Published: 2019-11-25
Description: If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.
CVSS Score: 7.4 (HIGH)
CWE: CWE-22, CWE-250
References: https://github.com/github/vscode-codeql/blob/v1.0.1/CHANGELOG.md; https://github.com/github/vscode-codeql/pull/174; https://github.com/github/vscode-codeql/security/advisories/GHSA-wf4x-8mpj-r42q