deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6113
Published: 2019-08-30
Description: Directory traversal vulnerability on ONKYO TX-NR686 [PII_REDACTED] A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot) and %2f to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.contextis.com/en/resources/advisories/cve-2019-6113; https://www.contextis.com/en/resources/advisories/cve-2019-6113
CVE: CVE-2019-9697
Published: 2019-08-30
Description: An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obtain passwords for external backup and CPL policy import servers that they might not otherwise be authorized to access.
CVSS Score: 6.5 (MEDIUM)
References: https://support.symantec.com/us/en/article.SYMSA1480.html; https://support.symantec.com/us/en/article.SYMSA1480.html
CVE: CVE-2015-9380
Published: 2019-08-30
Description: The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/photo-gallery/#developers; https://wordpress.org/support/topic/this-plugin-is-reported-as-vulnerable/; https://wpvulndb.com/vulnerabilities/7225
CVE: CVE-2019-15816
Published: 2019-08-30
Description: The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-601
References: https://blog.nintechnet.com/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin/; https://wordpress.org/plugins/wp-private-content-plus/#developers; https://wpvulndb.com/vulnerabilities/9817
CVE: CVE-2019-15817
Published: 2019-08-30
Description: The easy-property-listings plugin before 3.4 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-property-listings/#developers; https://wpvulndb.com/vulnerabilities/9511; https://wordpress.org/plugins/easy-property-listings/#developers
CVE: CVE-2019-15818
Published: 2019-08-30
Description: The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.nintechnet.com/unauthenticated-option-changes-in-wordpress-simple-301-redirects-addon-bulk-uploader-plugin/; https://wordpress.org/plugins/simple-301-redirects-addon-bulk-uploader/#developers; https://wpvulndb.com/vulnerabilities/9503
CVE: CVE-2019-15819
Published: 2019-08-30
Description: The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://blog.nintechnet.com/privilege-escalation-vulnerability-in-wordpress-nd-restaurant-reservations-plugin/; https://wordpress.org/plugins/nd-restaurant-reservations/#developers; https://wpvulndb.com/vulnerabilities/9501
CVE: CVE-2019-15820
Published: 2019-08-30
Description: The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.nintechnet.com/unauthenticated-options-change-in-wordpress-login-or-logout-menu-item-plugin/; https://wordpress.org/plugins/login-or-logout-menu-item/#developers; https://wpvulndb.com/vulnerabilities/9500
CVE: CVE-2019-15821
Published: 2019-08-30
Description: The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
CVSS Score: 7.5 (HIGH)
References: https://blog.nintechnet.com/critical-vulnerability-in-wordpress-bold-page-builder-plugin-currently-being-exploited/; https://wordpress.org/plugins/bold-page-builder/#developers; https://wpvulndb.com/vulnerabilities/9703
CVE: CVE-2019-15822
Published: 2019-08-30
Description: The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://secupress.me/blog/wps-child-theme-generator-v1-1-multiples-vulnerabilities/; https://wordpress.org/plugins/wps-child-theme-generator/#developers; https://wpvulndb.com/vulnerabilities/9470
CVE: CVE-2019-15823
Published: 2019-08-30
Description: The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/; https://wordpress.org/plugins/wps-hide-login/#developers; https://wpvulndb.com/vulnerabilities/9469
CVE: CVE-2019-15824
Published: 2019-08-30
Description: The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/; https://wordpress.org/plugins/wps-hide-login/#developers; https://wpvulndb.com/vulnerabilities/9469
CVE: CVE-2019-15825
Published: 2019-08-30
Description: The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
CVSS Score: 9.8 (CRITICAL)
References: https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/; https://wordpress.org/plugins/wps-hide-login/#developers; https://wpvulndb.com/vulnerabilities/9469
CVE: CVE-2019-15826
Published: 2019-08-30
Description: The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
CVSS Score: 9.8 (CRITICAL)
References: https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/; https://wordpress.org/plugins/wps-hide-login/#developers; https://wpvulndb.com/vulnerabilities/9469
CVE: CVE-2019-15827
Published: 2019-08-30
Description: The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/onesignal-free-web-push-notifications/#developers; https://wpvulndb.com/vulnerabilities/9478; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5530.php
CVE: CVE-2019-15828
Published: 2019-08-30
Description: The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/one-click-ssl/#developers; https://wpvulndb.com/vulnerabilities/9448; https://wordpress.org/plugins/one-click-ssl/#developers
CVE: CVE-2019-15829
Published: 2019-08-30
Description: The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/photoblocks-grid-gallery/#developers; https://wpvulndb.com/vulnerabilities/9443; https://wordpress.org/plugins/photoblocks-grid-gallery/#developers
CVE: CVE-2019-15830
Published: 2019-08-30
Description: The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2019/07/icegram-persistent-cross-site-scripting.html; https://wordpress.org/plugins/icegram/#developers; https://wpvulndb.com/vulnerabilities/9440
CVE: CVE-2019-15831
Published: 2019-08-30
Description: The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers; https://wpvulndb.com/vulnerabilities/9420; https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers
CVE: CVE-2019-15832
Published: 2019-08-30
Description: The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers; https://wpvulndb.com/vulnerabilities/9420; https://wordpress.org/plugins/visitors-traffic-real-time-statistics/#developers
CVE: CVE-2019-15833
Published: 2019-08-30
Description: The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/simple-mail-address-encoder/#developers; https://wpvulndb.com/vulnerabilities/9418; https://wordpress.org/plugins/simple-mail-address-encoder/#developers
CVE: CVE-2014-10060
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none
CVE: CVE-2014-10061
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none
CVE: CVE-2014-9982
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none
CVE: CVE-2014-9992
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none
CVE: CVE-2019-15026
Published: 2019-08-30
Description: memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00060.html; https://github.com/memcached/memcached/commit/554b56687a19300a75ec24184746b5512580c819; https://github.com/memcached/memcached/wiki/ReleaseNotes1517
CVE: CVE-2019-2389
Published: 2019-08-30
Description: Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-20
References: https://jira.mongodb.org/browse/SERVER-40563; https://jira.mongodb.org/browse/SERVER-40563
CVE: CVE-2019-2390
Published: 2019-08-30
Description: An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14 and MongoDB Server v3.4 prior to 3.4.22.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94
References: https://jira.mongodb.org/browse/SERVER-42233; https://jira.mongodb.org/browse/SERVER-42233
CVE: CVE-2014-10049
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2014. Notes: none
CVE: CVE-2016-10413
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10453
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10463
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10465
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10468
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10470
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10488
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-10500
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2017-18325
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18333
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18334
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18335
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18336
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18337
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18338
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18339
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18340
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2017-18341
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none
CVE: CVE-2018-11825
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11933
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11941
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11959
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11969
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11972
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11973
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11974
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11975
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11977
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11978
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2018-11989
Published: 2019-08-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2018. Notes: none
CVE: CVE-2019-12810
Published: 2019-08-30
Description: A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .PSD file can cause an out of bounds write vulnerability resulting in code execution. By persuading a victim to open a specially-crafted .PSD file, an attacker could execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35131; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35131
CVE: CVE-2019-15630
Published: 2019-08-30
Description: Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://help.salesforce.com/apex/HTViewSolution?urlname=CVE-2019-15630-Directory-Traversal-in-MuleSoft-Runtime&language=en_US; https://help.salesforce.com/apex/HTViewSolution?urlname=CVE-2019-15630-Directory-Traversal-in-MuleSoft-Runtime&language=en_US
CVE: CVE-2019-15834
Published: 2019-08-30
Description: The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/webp-converter-for-media/#developers; https://wpvulndb.com/vulnerabilities/9400; https://wordpress.org/plugins/webp-converter-for-media/#developers
CVE: CVE-2019-15835
Published: 2019-08-30
Description: The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-better-permalinks/#developers; https://wpvulndb.com/vulnerabilities/9398; https://wordpress.org/plugins/wp-better-permalinks/#developers
CVE: CVE-2019-15836
Published: 2019-08-30
Description: The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-ultimate-recipe/#developers; https://wpvulndb.com/vulnerabilities/9394; https://wordpress.org/plugins/wp-ultimate-recipe/#developers
CVE: CVE-2019-15837
Published: 2019-08-30
Description: The webp-express plugin before 0.14.8 for WordPress has stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/webp-express/#developers; https://wpvulndb.com/vulnerabilities/9389; https://wordpress.org/plugins/webp-express/#developers
CVE: CVE-2019-15838
Published: 2019-08-30
Description: The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/custom-404-pro/#developers; https://wpvulndb.com/vulnerabilities/9857; https://wordpress.org/plugins/custom-404-pro/#developers
CVE: CVE-2019-15839
Published: 2019-08-30
Description: The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-829
References: https://wordpress.org/plugins/sina-extension-for-elementor/#developers; https://wpvulndb.com/vulnerabilities/9368; https://www.pluginvulnerabilities.com/2019/06/18/our-proactive-monitoring-caught-a-local-file-inclusion-lfi-vulnerability-being-added-in-to-sina-extension-for-elementor/
CVE: CVE-2019-15840
Published: 2019-08-30
Description: The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/facebook-for-woocommerce/#developers; https://wordpress.org/plugins/facebook-for-woocommerce/#developers
CVE: CVE-2019-15841
Published: 2019-08-30
Description: The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/facebook-for-woocommerce/#developers; https://wordpress.org/plugins/facebook-for-woocommerce/#developers
CVE: CVE-2019-15842
Published: 2019-08-30
Description: The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-pdf-restaurant-menu-upload/#developers; https://wordpress.org/plugins/easy-pdf-restaurant-menu-upload/#developers
CVE: CVE-2019-15847
Published: 2019-09-02
Description: The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html
CVE: CVE-2015-9381
Published: 2019-09-03
Description: FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/type1/t1parse.c?id=7962a15d64c876870ca0ae435ea2467d9be268d9; https://access.redhat.com/errata/RHSA-2019:4254; https://lists.debian.org/debian-lts-announce/2019/09/msg00002.html
CVE: CVE-2015-9382
Published: 2019-09-03
Description: FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/psaux/psobjs.c?id=db5a4a9ae7b0048f[PII_REDACTED]21da8569642f73; https://access.redhat.com/errata/RHSA-2019:4254; https://lists.debian.org/debian-lts-announce/2019/09/msg00002.html