deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/main/java/com.thinkgem.jeesite/modules/act/service/ActProcessService.java. The attack vector is: network connectivity,authenticated,must upload a specially crafted xml file. The fixed version is: 4.0 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/service/ActProcessService.java; https://github.com/thinkgem/jeesite/blob/master/src/main/java/com/thinkgem/jeesite/modules/act/service/ActProcessService.java
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-681
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=23765; https://support.f5.com/csp/article/K05032915?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: LINAGORA hublin latest (commit 72ead[PII_REDACTED]26bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file (with a fixed extension) on the server. The component is: A web-view renderer; details here: https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1. The attack vector is: Attacker sends a specially crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1; https://lgtm.com/projects/g/linagora/hublin/snapshot/af9f1ce253b4ee923ff8da8f9d908d02a8e95b7f/files/backend/webserver/views.js?sort=name&dir=ASC&mode=heatmap&showExcluded=false#xb24eb0101d2aec21:1
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java; https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/her account. The fixed version is: 3.0.16.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0day.today/exploit/31255; https://packetstormsecurity.com/files/149665/wppieregister3015-xss.txt; https://seclists.org/bugtraq/2018/Oct/16
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor information disclosure of kernel stack. The component is: Veracrypt NT Driver (veracrypt.sys). The attack vector is: Locally executed code, IOCTL request to driver. The fixed version is: 1.23-Hotfix-1.
CVSS Score: 3.3 (LOW)
CWE: CWE-119
References: https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e; https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af; https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637; https://www.youtube.com/watch?v=K2HElM_ZYu4
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-23
Description: LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell session. The component is: adb shell (patches to fix this are at https://review.lineageos.org/c/LineageOS/android_system_core/+/234800, https://review.lineageos.org/c/LineageOS/android_device_lineage_sepolicy/+/234799). The attack vector is: When adb is enabled, and an attacker has physical access, `adb shell setprop service.adb.root 1` allows restarting adb as root.
CVSS Score: 6.8 (MEDIUM)
References: https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7; https://gist.github.com/zifnab06/e31ad63596b63a95e061bfe1f49ff0a7
CVE: CVE-2019-11691
Published: 2019-07-23
Description: A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1542465; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-11692
Published: 2019-07-23
Description: A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1544670; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-11693
Published: 2019-07-23
Description: The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1532525; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-11694
Published: 2019-07-23
Description: A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1534196; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-11695
Published: 2019-07-23
Description: A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. This vulnerability affects Firefox < 67.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1445844; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1445844
CVE: CVE-2019-11696
Published: 2019-07-23
Description: Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. This vulnerability affects Firefox < 67.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1392955; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1392955
CVE: CVE-2019-11697
Published: 2019-07-23
Description: If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1440079; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1440079
CVE: CVE-2019-11698
Published: 2019-07-23
Description: If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1543191; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://www.mozilla.org/security/advisories/mfsa2019-14/
CVE: CVE-2019-11699
Published: 2019-07-23
Description: A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks. This vulnerability affects Firefox < 67.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1528939; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1528939
CVE: CVE-2019-11700
Published: 2019-07-23
Description: A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 67.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1549833; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1549833
CVE: CVE-2019-11701
Published: 2019-07-23
Description: The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. *Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.*. This vulnerability affects Firefox < 67.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1518627; https://www.mozilla.org/security/advisories/mfsa2019-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1518627
CVE: CVE-2019-11702
Published: 2019-07-23
Description: A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 67.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1552627; https://www.mozilla.org/security/advisories/mfsa2019-16/; https://bugzilla.mozilla.org/show_bug.cgi?id=1552627
CVE: CVE-2019-11703
Published: 2019-07-23
Description: A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1553820; https://security.gentoo.org/glsa/201908-20; https://www.mozilla.org/security/advisories/mfsa2019-17/
CVE: CVE-2019-11704
Published: 2019-07-23
Description: A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1553814; https://security.gentoo.org/glsa/201908-20; https://www.mozilla.org/security/advisories/mfsa2019-17/
CVE: CVE-2019-11705
Published: 2019-07-23
Description: A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1553808; https://security.gentoo.org/glsa/201908-20; https://www.mozilla.org/security/advisories/mfsa2019-17/
CVE: CVE-2019-11706
Published: 2019-07-23
Description: A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. This vulnerability affects Thunderbird < 60.7.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1555646; https://security.gentoo.org/glsa/201908-20; https://www.mozilla.org/security/advisories/mfsa2019-17/
CVE: CVE-2019-11707
Published: 2019-07-23
Description: A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1544386; https://security.gentoo.org/glsa/201908-12; https://www.mozilla.org/security/advisories/mfsa2019-18/
CVE: CVE-2019-11708
Published: 2019-07-23
Description: Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1559858; https://security.gentoo.org/glsa/201908-12
CVE: CVE-2019-11709
Published: 2019-07-23
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11710
Published: 2019-07-23
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 68.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11711
Published: 2019-07-23
Description: When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11712
Published: 2019-07-23
Description: POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11713
Published: 2019-07-23
Description: A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11714
Published: 2019-07-23
Description: Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 68.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11715
Published: 2019-07-23
Description: Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11716
Published: 2019-07-23
Description: Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed. This vulnerability affects Firefox < 68.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11717
Published: 2019-07-23
Description: A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11718
Published: 2019-07-23
Description: Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1408349
CVE: CVE-2019-11719
Published: 2019-07-23
Description: When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
CVE: CVE-2019-11720
Published: 2019-07-23
Description: Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering. This vulnerability affects Firefox < 68.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
CVE: CVE-2019-11721
Published: 2019-07-23
Description: The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as punycode text, allowing for user confusion. This vulnerability affects Firefox < 68.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html