deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-8229
Published: 2019-07-03
Description: Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-8230
Published: 2019-07-03
Description: On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrative interface of the device can add a new administrative user to the interface using HTTP APIs provided by the device and perform all the actions as an administrative user by using that account. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable functions that performs the various action described in HTTP APIs. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 0x00429084 in IDA pro is the one that processes the HTTP API request for "addUser" action. If one traces the calls to this function, it can be clearly seen that the function sub_ 41F38C at address 0x0041F588 parses the call received from the browser and passes it to the "addUser" function without any authorization check.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf; http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html
CVE: CVE-2018-14859
Published: 2019-07-03
Description: Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset the password of other users by being the first party to use the secure token.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/odoo/odoo/issues/32510; https://github.com/odoo/odoo/issues/32510
CVE: CVE-2018-14860
Published: 2019-07-03
Description: Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://github.com/odoo/odoo/issues/32505; https://github.com/odoo/odoo/issues/32505
CVE: CVE-2019-10101
Published: 2019-07-03
Description: JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-10102
Published: 2019-07-03
Description: JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-10103
Published: 2019-07-03
Description: JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12841
Published: 2019-07-03
Description: Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12842
Published: 2019-07-03
Description: A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12843
Published: 2019-07-03
Description: A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12844
Published: 2019-07-03
Description: A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12845
Published: 2019-07-03
Description: The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12846
Published: 2019-07-03
Description: A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-12852
Published: 2019-07-03
Description: An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/; https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
CVE: CVE-2019-13207
Published: 2019-07-03
Description: nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/NLnetLabs/nsd/issues/20; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS4H7WVHQGCX3LF72F5K22VJXN7HDBB/; https://github.com/NLnetLabs/nsd/issues/20
CVE: CVE-2015-3907
Published: 2019-07-03
Description: CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://kb.hitcon.org/post/[PII_REDACTED]7/codeigniter-rest-server-module-xxe-cve-2015-3907; https://kb.hitcon.org/post/[PII_REDACTED]7/codeigniter-rest-server-module-xxe-cve-2015-3907
CVE: CVE-2019-13074
Published: 2019-07-03
Description: A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource management.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://forum.mikrotik.com/viewtopic.php?t=150045; https://mikrotik.com/download/changelogs/stable-release-tree; https://forum.mikrotik.com/viewtopic.php?t=150045
CVE: CVE-2019-9827
Published: 2019-07-03
Description: Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://www.ciphertechs.com/hawtio-advisory/; https://www.ciphertechs.com/hawtio-advisory/
CVE: CVE-2019-13208
Published: 2019-07-03
Description: WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, leading to DLL side loading. This affects WavesSysSvc64.exe 1.9.29.0.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://versprite.com/blog/security-research/windows-registry/; https://versprite.com/blog/security-research/windows-registry/
CVE: CVE-2019-13226
Published: 2019-07-04
Description: deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/<block-dev-basename> in the Helper::temporaryMountDevice() function to temporarily mount a file system as root. An unprivileged user can prepare a symlink at this location to have the file system mounted in an arbitrary location. By winning a race condition, the attacker can also enter the mount point, thereby preventing a subsequent unmount of the file system.
CVSS Score: 7.0 (HIGH)
CWE: CWE-59, CWE-362
References: http://www.openwall.com/lists/oss-security/2019/07/04/1; https://bugzilla.suse.com/show_bug.cgi?id=1130388; https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab
CVE: CVE-2019-13227
Published: 2019-07-04
Description: In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2019/07/04/1; https://bugzilla.suse.com/show_bug.cgi?id=1130388; https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab
CVE: CVE-2019-13228
Published: 2019-07-04
Description: deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled. By winning a race condition to replace the /tmp/repo.iso symlink by an attacker controlled ISO file, further privilege escalation may be possible.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2019/07/04/1; https://bugzilla.suse.com/show_bug.cgi?id=1130388; https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab
CVE: CVE-2019-13229
Published: 2019-07-04
Description: deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2019/07/04/1; https://bugzilla.suse.com/show_bug.cgi?id=1130388; https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab
CVE: CVE-2019-13232
Published: 2019-07-04
Description: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-400
References: https://github.com/madler/unzip; https://lists.debian.org/debian-lts-announce/2019/07/msg00005.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00027.html
CVE: CVE-2019-13233
Published: 2019-07-04
Description: In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html; http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html; https://access.redhat.com/errata/RHSA-2019:3309
CVE: CVE-2018-20850
Published: 2019-07-04
Description: Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://advisories.stormshield.eu/2018-006/; https://advisories.stormshield.eu/2018-006/
CVE: CVE-2019-13238
Published: 2019-07-04
Description: An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the program allocates a new buffer to parse an atom in the stream. The unhandled memory allocation failure causes a direct copy to a NULL pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/396; https://github.com/axiomatic-systems/Bento4/issues/396
CVE: CVE-2019-13239
Published: 2019-07-04
Description: inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/c2aa7a7cd6af28be3809acc7e7842d2d2008c0fb; https://github.com/glpi-project/glpi/releases/tag/9.4.3; https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_stored_XSS.pdf
CVE: CVE-2019-13241
Published: 2019-07-04
Description: FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/Sigil-Ebook/flightcrew/issues/52; https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-3-of-3/; https://usn.ubuntu.com/4055-1/
CVE: CVE-2019-13242
Published: 2019-07-04
Description: IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x[PII_REDACTED]013a98.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/irfanview/0x[PII_REDACTED]013a98.md; https://github.com/apriorit/pentesting/blob/master/bugs/irfanview/0x[PII_REDACTED]013a98.md
CVE: CVE-2019-13243
Published: 2019-07-04
Description: IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x[PII_REDACTED]0249c6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/irfanview/0x[PII_REDACTED]0249c6.md; https://github.com/apriorit/pentesting/blob/master/bugs/irfanview/0x[PII_REDACTED]0249c6.md
CVE: CVE-2019-13244
Published: 2019-07-04
Description: FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x[PII_REDACTED]002d7d.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]002d7d.md; https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]002d7d.md
CVE: CVE-2019-13245
Published: 2019-07-04
Description: FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x[PII_REDACTED]1a95b1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]1a95b1.md; https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]1a95b1.md
CVE: CVE-2019-13246
Published: 2019-07-04
Description: FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x[PII_REDACTED]1a9601.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]1a9601.md; https://github.com/apriorit/pentesting/blob/master/bugs/fsview/0x[PII_REDACTED]1a9601.md
CVE: CVE-2019-13247
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x[PII_REDACTED]0024ed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0024ed.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0024ed.md
CVE: CVE-2019-13248
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x[PII_REDACTED]002450.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]002450.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]002450.md
CVE: CVE-2019-13249
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x[PII_REDACTED]0b9e7a.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0b9e7a.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0b9e7a.md
CVE: CVE-2019-13250
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x[PII_REDACTED]0b9c2f.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0b9c2f.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0b9c2f.md
CVE: CVE-2019-13251
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x[PII_REDACTED]0c47ff.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0c47ff.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]0c47ff.md
CVE: CVE-2019-13252
Published: 2019-07-04
Description: ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x[PII_REDACTED]1172b0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]1172b0.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee/0x[PII_REDACTED]1172b0.md
CVE: CVE-2019-13253
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]385474.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]385474.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]385474.md
CVE: CVE-2019-13254
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]32e808.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e808.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e808.md
CVE: CVE-2019-13255
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]327464.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]327464.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]327464.md
CVE: CVE-2019-13256
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]32e849.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e849.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e849.md
CVE: CVE-2019-13257
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]3273aa.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]3273aa.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]3273aa.md
CVE: CVE-2019-13258
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]328165.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]328165.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]328165.md
CVE: CVE-2019-13259
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]32e566.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e566.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]32e566.md
CVE: CVE-2019-13260
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]327a07.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]327a07.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]327a07.md
CVE: CVE-2019-13261
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]328384.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]328384.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]328384.md
CVE: CVE-2019-13262
Published: 2019-07-04
Description: XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x[PII_REDACTED]3283eb.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]3283eb.md; https://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x[PII_REDACTED]3283eb.md