deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16267
Published: 2020-01-22
Description: The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://review.tizen.org/git/?p=platform/core/system/system-popup.git%3Ba=commit%3Bh=57b3c2f3cd61c6f432e7abe3a2d8b0df72fd4b0e; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE: CVE-2018-16268
Published: 2020-01-22
Description: The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://review.tizen.org/git/?p=platform/core/multimedia/libmm-sound.git%3Ba=commit%3Bh=7fce6f2d6d480b3bd0e84a5ba3f72173a37e36db; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
CVE: CVE-2018-16269
Published: 2020-01-22
Description: The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be; https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
CVE: CVE-2018-16270
Published: 2020-01-22
Description: Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be; https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
CVE: CVE-2018-16271
Published: 2020-01-22
Description: The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be; https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
CVE: CVE-2018-16272
Published: 2020-01-22
Description: The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf; https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be; https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
CVE: CVE-2019-10780
Published: 2020-01-22
Description: BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-RUBY-BIBTEXRUBY-542602; https://snyk.io/vuln/SNYK-RUBY-BIBTEXRUBY-542602
CVE: CVE-2019-10781
Published: 2020-01-22
Description: In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://github.com/Atinux/schema-inspector/commit/345a7b2eed11bb[PII_REDACTED]d65f4f83fdbb737d; https://snyk.io/vuln/SNYK-JS-SCHEMAINSPECTOR-536970; https://github.com/Atinux/schema-inspector/commit/345a7b2eed11bb[PII_REDACTED]d65f4f83fdbb737d
CVE: CVE-2019-6858
Published: 2020-01-22
Description: A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalation when injecting a malicious DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.se.com/ww/en/download/document/SEVD-2020-014-01; https://www.se.com/ww/en/download/document/SEVD-2020-014-01
CVE: CVE-2011-3582
Published: 2020-01-22
Description: A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.openwall.com/lists/oss-security/2011/09/30/3; https://www.openwall.com/lists/oss-security/2011/09/30/3
CVE: CVE-2019-18583
Published: 2020-01-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18584
Published: 2020-01-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18585
Published: 2020-01-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18586
Published: 2020-01-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2020-6959
Published: 2020-01-22
Description: The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch are vulnerable to an unsafe deserialization of untrusted data. An attacker may be able to remotely modify deserialized data without authentication using a specially crafted web request, resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.us-cert.gov/ics/advisories/icsa-20-021-01; https://www.us-cert.gov/ics/advisories/icsa-20-021-01
CVE: CVE-2020-6960
Published: 2020-01-22
Description: The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch, MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch, MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch, and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch contain an SQL injection vulnerability that could give an attacker remote unauthenticated access to the web user interface with administrator-level privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.us-cert.gov/ics/advisories/icsa-20-021-01; https://www.us-cert.gov/ics/advisories/icsa-20-021-01
CVE: CVE-2020-7228
Published: 2020-01-22
Description: The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://spider-security.co.uk/blog-cve-2020-7228; https://wordpress.org/plugins/calculated-fields-form/#developers; https://wpvulndb.com/vulnerabilities/10043
CVE: CVE-2011-3595
Published: 2020-01-22
Description: Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://yehg.net/lab/pr0js/advisories/joomla/core/%5Bjoomla_1.7.0-stable%5D_cross_site_scripting%28XSS%29; https://www.openwall.com/lists/oss-security/2011/10/04/7; https://www.rapid7.com/db/vulnerabilities/joomla-20110902-core-xss-vulnerability
CVE: CVE-2011-3610
Published: 2020-01-22
Description: A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://git.schokokeks.org/freewvs.git/blob/ddc4be296c9c49987b53be064d6d2a9d12f50452/freewvsdb/plugins.freewvs; https://packetstormsecurity.com/files/105054/Secunia-Security-Advisory-46005.html; https://www.openwall.com/lists/oss-security/2011/10/10/3
CVE: CVE-2011-3611
Published: 2020-01-22
Description: A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://packetstormsecurity.com/files/100103/UseBB-1.0.11-Cross-Site-Request-Forgery-Local-File-Inclusion.html; https://www.immuniweb.com/advisory/HTB22913; https://www.openwall.com/lists/oss-security/2011/10/10/4
CVE: CVE-2019-6146
Published: 2020-01-22
Description: It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/156274/Forcepoint-WebSecurity-8.5-Cross-Site-Scripting.html; https://help.forcepoint.com/security/CVE/CVE-2019-6146.html; http://packetstormsecurity.com/files/156274/Forcepoint-WebSecurity-8.5-Cross-Site-Scripting.html
CVE: CVE-2020-7109
Published: 2020-01-22
Description: The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
CVSS Score: 9.8 (CRITICAL)
References: https://wordpress.org/plugins/elementor/#developers; https://wordpress.org/plugins/elementor/#developers
CVE: CVE-2011-3612
Published: 2020-01-22
Description: Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/100103/UseBB-1.0.11-Cross-Site-Request-Forgery-Local-File-Inclusion.html; https://www.immuniweb.com/advisory/HTB22913; https://www.openwall.com/lists/oss-security/2011/10/10/4
CVE: CVE-2011-3613
Published: 2020-01-22
Description: An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://packetstormsecurity.com/files/105853/Secunia-Security-Advisory-46387.html; https://www.openwall.com/lists/oss-security/2011/10/10/5; https://packetstormsecurity.com/files/105853/Secunia-Security-Advisory-46387.html
CVE: CVE-2011-3614
Published: 2020-01-22
Description: An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
CVSS Score: 9.8 (CRITICAL)
References: https://packetstormsecurity.com/files/105853/Secunia-Security-Advisory-46387.html; https://www.openwall.com/lists/oss-security/2011/10/10/5; https://packetstormsecurity.com/files/105853/Secunia-Security-Advisory-46387.html
CVE: CVE-2011-3621
Published: 2020-01-22
Description: A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
CVSS Score: 9.8 (CRITICAL)
References: https://fluxbb.org/forums/viewtopic.php?id=5751; https://www.openwall.com/lists/oss-security/2011/10/18/8; https://fluxbb.org/forums/viewtopic.php?id=5751
CVE: CVE-2019-5647
Published: 2020-01-22
Description: The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://help.rapid7.com/appspiderenterprise/release-notes/?rid=3.8.215; https://help.rapid7.com/appspiderenterprise/release-notes/?rid=3.8.215
CVE: CVE-2012-4919
Published: 2020-01-22
Description: Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: http://www.securityfocus.com/bid/57650; https://exchange.xforce.ibmcloud.com/vulnerabilities/81713; http://www.securityfocus.com/bid/57650
CVE: CVE-2016-4761
Published: 2020-01-22
Description: WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2016/11/04/14; http://www.ubuntu.com/usn/USN-3166-1; http://www.openwall.com/lists/oss-security/2016/11/04/14
CVE: CVE-2019-16792
Published: 2020-01-22
Description: Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-444, CWE-444
References: https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes; https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65; https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6
CVE: CVE-2019-19834
Published: 2020-01-22
Description: Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19836
Published: 2020-01-22
Description: AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19843
Published: 2020-01-22
Description: Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-552
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2020-5221
Published: 2020-01-22
Description: In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in version 2.11
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fe; https://github.com/troglobit/uftpd/security/advisories/GHSA-wmx8-v7mx-6x9h; https://github.com/troglobit/uftpd/commit/455b47d3756aed162d2d0ef7f40b549f3b5b30fe
CVE: CVE-2011-3622
Published: 2020-01-22
Description: A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/10/18/9; https://www.phorum.org/phorum5/read.php?64%2C149588; https://www.openwall.com/lists/oss-security/2011/10/18/9
CVE: CVE-2019-19840
Published: 2020-01-22
Description: A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19841
Published: 2020-01-22
Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/_cmdstat.jsp via the mac attribute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-19842
Published: 2020-01-22
Description: emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/_cmdstat.jsp via the mac attribute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://alephsecurity.com/2020/01/14/ruckus-wireless; https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10816.html; https://www.ruckuswireless.com/security/299/view/txt
CVE: CVE-2019-20391
Published: 2020-01-22
Description: An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793934; https://github.com/CESNET/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8; https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
CVE: CVE-2019-20392
Published: 2020-01-22
Description: An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793922; https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be5; https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
CVE: CVE-2019-20393
Published: 2020-01-22
Description: A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793930; https://github.com/CESNET/libyang/commit/d9feacc4a590d35dbc1af21caf9080008b4450ed; https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
CVE: CVE-2019-20394
Published: 2020-01-22
Description: A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793932; https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074ada65e8523289a6; https://github.com/CESNET/libyang/compare/v1.0-r2...v1.0-r3
CVE: CVE-2019-20395
Published: 2020-01-22
Description: A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793924; https://github.com/CESNET/libyang/commit/4e610ccd87a2ba[PII_REDACTED]d508f71163fcc237; https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1
CVE: CVE-2019-20396
Published: 2020-01-22
Description: A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8; https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1; https://github.com/CESNET/libyang/issues/740
CVE: CVE-2019-20397
Published: 2020-01-22
Description: A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://bugzilla.redhat.com/show_bug.cgi?id=1793928; https://github.com/CESNET/libyang/commit/88bd6c548ba79bce176cd875e9b56e7e0ef4d8d4; https://github.com/CESNET/libyang/compare/v0.16-r3...v1.0-r1