deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18548
Published: 2019-08-16
Description: The note-press plugin before 0.1.2 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/note-press/#developers; https://wordpress.org/plugins/note-press/#developers
CVE: CVE-2018-13884
Published: 2019-08-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2019-15117
Published: 2019-08-16
Description: parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-15118
Published: 2019-08-16
Description: check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE: CVE-2019-15119
Published: 2019-08-16
Description: lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/cnlh/nps/commit/7178b3380720e910d283036a8d39879a94105515; https://github.com/cnlh/nps/issues/176; https://github.com/cnlh/nps/commit/7178b3380720e910d283036a8d39879a94105515
CVE: CVE-2019-15120
Published: 2019-08-16
Description: The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/h3llraiser/CVE-2019-15120; https://vel.joomla.org/resolved/2260-kunena-5-0-x-5-1-14-xss-cross-site-scripting; https://www.kunena.org/blog/207-kunena-5-1-14-released
CVE: CVE-2019-5477
Published: 2019-08-16
Description: A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/sparklemotion/nokogiri/issues/1915; https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc; https://hackerone.com/reports/650835
CVE: CVE-2019-7957
Published: 2019-08-16
Description: Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability. Successful exploitation could lead to denial of service.
CVSS Score: 7.5 (HIGH)
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html
CVE: CVE-2019-7958
Published: 2019-08-16
Description: Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html
CVE: CVE-2019-7959
Published: 2019-08-16
Description: Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html
CVE: CVE-2019-7964
Published: 2019-08-16
Description: Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. Successful exploitation could lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://helpx.adobe.com/security/products/experience-manager/apsb19-42.html; https://helpx.adobe.com/security/products/experience-manager/apsb19-42.html
CVE: CVE-2019-8063
Published: 2019-08-16
Description: Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. Successful exploitation could lead to information leakage.
CVSS Score: 7.5 (HIGH)
References: https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html; https://helpx.adobe.com/security/products/creative-cloud/apsb19-39.html
CVE: CVE-2014-10376
Published: 2019-08-16
Description: The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/i-recommend-this/#developers; https://wordpress.org/plugins/i-recommend-this/#developers
CVE: CVE-2015-9322
Published: 2019-08-16
Description: The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/erident-custom-login-and-dashboard/#developers; https://wordpress.org/plugins/erident-custom-login-and-dashboard/#developers
CVE: CVE-2015-9323
Published: 2019-08-16
Description: The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2015-9323; https://wordpress.org/plugins/404-to-301/#developers; https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2015-9323
CVE: CVE-2015-9324
Published: 2019-08-16
Description: The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/easy-digital-downloads/#developers; https://wpvulndb.com/vulnerabilities/9770; https://wordpress.org/plugins/easy-digital-downloads/#developers
CVE: CVE-2017-18541
Published: 2019-08-16
Description: The xo-security plugin before 1.5.3 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/xo-security/#developers; https://wordpress.org/plugins/xo-security/#developers
CVE: CVE-2017-18542
Published: 2019-08-16
Description: The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/zendesk-help-center/#developers; https://wordpress.org/plugins/zendesk-help-center/#developers
CVE: CVE-2017-18543
Published: 2019-08-16
Description: The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://wordpress.org/plugins/invite-anyone/#developers; https://wordpress.org/plugins/invite-anyone/#developers
CVE: CVE-2017-18544
Published: 2019-08-16
Description: The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/invite-anyone/#developers; https://wordpress.org/plugins/invite-anyone/#developers
CVE: CVE-2017-18545
Published: 2019-08-16
Description: The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://wordpress.org/plugins/invite-anyone/#developers; https://wordpress.org/plugins/invite-anyone/#developers
CVE: CVE-2017-18546
Published: 2019-08-16
Description: The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/jayj-quicktag/#developers; https://wordpress.org/plugins/jayj-quicktag/#developers
CVE: CVE-2017-18547
Published: 2019-08-16
Description: The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/nelio-ab-testing/#developers; https://wordpress.org/plugins/nelio-ab-testing/#developers
CVE: CVE-2018-20971
Published: 2019-08-16
Description: The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/church-admin/#developers; https://wordpress.org/plugins/church-admin/#developers
CVE: CVE-2018-20972
Published: 2019-08-16
Description: The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/companion-auto-update/#developers; https://wordpress.org/plugins/companion-auto-update/#developers
CVE: CVE-2018-20973
Published: 2019-08-16
Description: The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://wordpress.org/plugins/companion-auto-update/#developers; https://wordpress.org/plugins/companion-auto-update/#developers
CVE: CVE-2018-20974
Published: 2019-08-16
Description: The js-jobs plugin before 1.0.7 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/js-jobs/#developers; https://wordpress.org/plugins/js-jobs/#developers
CVE: CVE-2019-15113
Published: 2019-08-16
Description: The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/companion-sitemap-generator/#developers; https://wordpress.org/plugins/companion-sitemap-generator/#developers
CVE: CVE-2019-15114
Published: 2019-08-16
Description: The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/formcraft-form-builder/#developers; https://wordpress.org/plugins/formcraft-form-builder/#developers
CVE: CVE-2019-15115
Published: 2019-08-16
Description: The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/peters-login-redirect/#developers; https://wordpress.org/plugins/peters-login-redirect/#developers
CVE: CVE-2019-15116
Published: 2019-08-16
Description: The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-digital-downloads/#developers; https://wpvulndb.com/vulnerabilities/9334; https://wordpress.org/plugins/easy-digital-downloads/#developers
CVE: CVE-2019-13069
Published: 2019-08-17
Description: extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.config.sqlite with a version containing an additional user account, and then use SSH and port forwarding to reach a 127.0.0.1 service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://kb.extenua.com; https://www.fobz.net/adv/ag47ex/info.html; http://kb.extenua.com
CVE: CVE-2019-14937
Published: 2019-08-17
Description: REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://gist.github.com/hiennv20/6739606a4d0d25612f5139ec391060b7; https://projectredcap.org/resources/community/; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
CVE: CVE-2019-15132
Published: 2019-08-17
Description: Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html; https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html; https://support.zabbix.com/browse/ZBX-16532
CVE: CVE-2019-15133
Published: 2019-08-17
Description: In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13008; https://lists.debian.org/debian-lts-announce/2022/12/msg00008.html; https://usn.ubuntu.com/4107-1/
CVE: CVE-2019-15134
Published: 2019-08-17
Description: RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/RIOT-OS/RIOT/pull/12001; https://github.com/RIOT-OS/RIOT/pull/12001
CVE: CVE-2019-15135
Published: 2019-08-18
Description: The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability information on a Data Distribution Service (DDS) network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://arxiv.org/abs/1908.05310; https://www.omg.org/spec/DDS-SECURITY/1.1/PDF; https://arxiv.org/abs/1908.05310
CVE: CVE-2019-15136
Published: 2019-08-18
Description: The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://arxiv.org/abs/1908.05310; https://github.com/eProsima/Fast-RTPS/issues/443; https://arxiv.org/abs/1908.05310
CVE: CVE-2019-15137
Published: 2019-08-18
Description: The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.
CVSS Score: 7.5 (HIGH)
References: https://arxiv.org/abs/1908.05310; https://github.com/eProsima/Fast-RTPS/issues/441; https://arxiv.org/abs/1908.05310
CVE: CVE-2019-15129
Published: 2019-08-18
Description: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd; https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd
CVE: CVE-2019-15130
Published: 2019-08-18
Description: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd; https://gist.github.com/izadgot/38a7dd553f8024ed3154134dae0414fd
CVE: CVE-2019-15139
Published: 2019-08-18
Description: The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/commit/c78993d138bf480ab4652b5a48379d4ff75ba5f7
CVE: CVE-2019-15140
Published: 2019-08-18
Description: coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/commit/f7206618d27c2e69d977abf40e3035a33e5f6be0
CVE: CVE-2019-15141
Published: 2019-08-18
Description: WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html; https://github.com/ImageMagick/ImageMagick/issues/1560
CVE: CVE-2019-15142
Published: 2019-08-18
Description: In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read) by crafting a DJVU file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html; https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
CVE: CVE-2019-15143
Published: 2019-08-18
Description: In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error (resource exhaustion caused by a GBitmap::read_rle_raw infinite loop) by crafting a corrupted image file, related to libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html; https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
CVE: CVE-2019-15144
Published: 2019-08-18
Description: In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mishandled in libdjvu/GContainer.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html; https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
CVE: CVE-2019-15145
Published: 2019-08-18
Description: DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html; https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
CVE: CVE-2019-15146
Published: 2019-08-18
Description: GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681; https://github.com/gopro/gpmf-parser/issues/60; https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681
CVE: CVE-2019-15147
Published: 2019-08-18
Description: GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681; https://github.com/gopro/gpmf-parser/issues/60; https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681
CVE: CVE-2019-15148
Published: 2019-08-18
Description: GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681; https://github.com/gopro/gpmf-parser/issues/60; https://github.com/gopro/gpmf-parser/commit/341f12cd5b97ab419e53853ca00176457c9f1681
CVE: CVE-2019-15149
Published: 2019-08-18
Description: core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-254
References: https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc; https://mitogen.networkgenomics.com/changelog.html#v0-2-8-2019-08-18; https://github.com/dw/mitogen/commit/5924af1566763e48c42028399ea0cd95c457b3dc
CVE: CVE-2019-15151
Published: 2019-08-18
Description: AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://github.com/adplug/adplug/issues/91; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q32A64R2APAC5PXIMSYIEFDQX5AD4GAS/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3PW6PLDTPSQQRHKTU2FB72SUB4Q66NE/
CVE: CVE-2016-10905
Published: 2019-08-19
Description: An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html; http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=36e4ad0316c017d5b271378ed9a1c9a4b77fab5f