deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registers. The component is: ioctl handling. The attack vector is: An attacker could exploit a bug in ioctl interface whitelist checking, in order to write to model specific registers, normally a function reserved for the root user. The fixed version is: v1.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-862
References: https://github.com/LLNL/msr-safe/compare/v1.1.0...v1.2.0; https://www.tldp.org/LDP/lkmpg/2.4/html/x856.html; https://github.com/LLNL/msr-safe/compare/v1.1.0...v1.2.0
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The component is: front.c, function txt_add. The fixed version is: after commit commit 08aef597656d065e86075f3d53fda89765845eae.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://drive.google.com/drive/u/2/folders/1Y2IbtEr9v4l4Ruie_AY9BFJOHOGiDt7S; https://github.com/leesavide/abcm2ps/issues/18; https://lists.debian.org/debian-lts-announce/2022/04/msg00015.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-10238. Reason: This issue was MERGED into CVE-2018-10238 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2018-10238 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-13575
Published: 2019-07-18
Description: A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fortiguard.com/zeroday/FG-VD-19-096; https://github.com/wpeverest/everest-forms/commit/755d095fe0d9a756a13800d1513cf98219e4a3f9; https://github.com/wpeverest/everest-forms/commit/755d095fe0d9a756a13800d1513cf98219e4a3f9#diff-bb2b21ef7774df8687ff02b0284505c6
CVE: CVE-2019-13607
Published: 2019-07-18
Description: The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.rakeshmane.com/2019/07/u-xss-in-operamini-for-ios-browser-0-day.html; https://blog.rakeshmane.com/2019/07/u-xss-in-operamini-for-ios-browser-0-day.html
CVE: CVE-2019-13915
Published: 2019-07-18
Description: b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59, CWE-74
References: https://github.com/b3log/wide/issues/355; https://github.com/b3log/wide/issues/355
CVE: CVE-2019-9230
Published: 2019-07-18
Description: An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting (XSS) vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf; https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack vector is: Crafted ajax request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://metalamin.github.io/Quick-Chat-SQLi-EN/; https://metalamin.github.io/Quick-Chat-SQLi-EN/
CVE: CVE-2019-13509
Published: 2019-07-18
Description: In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html; http://www.securityfocus.com/bid/109253; https://docs.docker.com/engine/release-notes/
CVE: CVE-2019-13948
Published: 2019-07-18
Description: SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html; https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22-SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md; https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html
CVE: CVE-2019-13949
Published: 2019-07-18
Description: SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html; https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22-SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md; https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html
CVE: CVE-2019-13950
Published: 2019-07-18
Description: index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html; https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22-SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md; https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html
CVE: CVE-2019-3570
Published: 2019-07-18
Description: Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/facebook/hhvm/commit/cc331e4349e91706a673e2a09f1f2ea5bbb33815; https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.html; https://github.com/facebook/hhvm/commit/cc331e4349e91706a673e2a09f1f2ea5bbb33815
CVE: CVE-2019-3734
Published: 2019-07-18
Description: Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users.
CVSS Score: 5.4 (MEDIUM)
References: https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities; https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities
CVE: CVE-2019-3741
Published: 2019-07-18
Description: Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privilege user) password is stored in a plain text in Unity Data Collection bundle (logs files for troubleshooting). A local authenticated attacker with access to the Data Collection bundle may use the exposed password to gain access with the privileges of the compromised user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities; https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities
CVE: CVE-2019-3794
Published: 2019-07-18
Description: Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-1021
References: https://www.cloudfoundry.org/blog/cve-2019-3794; https://www.cloudfoundry.org/blog/cve-2019-3794
CVE: CVE-2019-9231
Published: 2019-07-18
Description: An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery (CSRF) vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions, because CSRFProtection=1 is not a default and is not documented.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf; https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/sleuthkit/sleuthkit/commit/114cd3d0aac8bd1aeaf4b33840feb0163d342d5b; https://issuetracker.google.com/issues/77809383; https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a; https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534; https://github.com/saltstack/salt/pull/51462
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/go-gitea/gitea/pull/5905; https://github.com/go-gitea/gitea/pull/5905
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a reservation duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee[PII_REDACTED]067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee[PII_REDACTED]067/src/ladon/interfaces/soap.py#lines-688; https://www.exploit-db.com/exploits/43113; https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee[PII_REDACTED]067/src/ladon/interfaces/soap.py#lines-688
CVE: CVE-2019-11230
Published: 2019-07-18
Description: In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the symlink is renamed. This defect can be exploited to rename a critical product file (e.g., AvastSvc.exe), causing the product to fail to start on the next system restart.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://www.mcerlane.co.uk/CVE-2019-11230/; http://www.securityfocus.com/bid/109344; http://www.mcerlane.co.uk/CVE-2019-11230/
CVE: CVE-2019-13951
Published: 2019-07-18
Description: The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/gdnsd/gdnsd/issues/185; https://github.com/gdnsd/gdnsd/issues/185
CVE: CVE-2019-13952
Published: 2019-07-18
Description: The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/gdnsd/gdnsd/issues/185; https://github.com/gdnsd/gdnsd/issues/185
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://sourceforge.net/projects/i-doit/files/i-doit/1.12.1/CHANGELOG/download; https://sourceforge.net/projects/i-doit/files/i-doit/1.12.1/CHANGELOG/download
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-190
References: https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD; https://drive.google.com/open?id=1LxmTXZS-FRJQHAzO2JPgDx5SbLNEJHuJ; https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1; https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD; https://drive.google.com/open?id=17RsaP67w6M2xquQjFf2vXhX3dlVKMdC1
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef[PII_REDACTED]160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe; https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef[PII_REDACTED]160de356158b; https://redmine.openinfosecfoundation.org/issues/2736
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD; https://drive.google.com/open?id=1ce1uqcJYI-sEENGbPmmw-uJTwCXTUyJn; https://drive.google.com/open?id=1HtdRdf88Nv3RNeQJM9fQ6egY5X-tuewD
CVE: CVE-2019-13956
Published: 2019-07-18
Description: Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://esoln.net/esoln/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerability/; http://esoln.net/esoln/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerability/
CVE: CVE-2019-3592
Published: 2019-07-18
Description: Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory.
CVSS Score: 7.2 (HIGH)
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10288; https://kc.mcafee.com/corporate/index?page=content&id=SB10288
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/LiodAir/images/blob/master/csrf.md; https://github.com/LiodAir/images/blob/master/csrf.md
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9; https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-18
Description: Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/OISF/suricata/pull/3625; https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b; https://redmine.openinfosecfoundation.org/issues/2770
CVE: CVE-2019-13959
Published: 2019-07-18
Description: In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. This is different from CVE-2018-20186.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/394; https://github.com/axiomatic-systems/Bento4/issues/394
CVE: CVE-2019-13960
Published: 2019-07-18
Description: In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/337; https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf; https://github.com/libjpeg-turbo/libjpeg-turbo/issues/337
CVE: CVE-2019-8286
Published: 2019-07-18
Description: Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage (for example, via clicking phishing link). Vulnerability has CVSS v3.0 base score 2.6
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/109300; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#110719; http://www.securityfocus.com/bid/109300
CVE: CVE-2019-13961
Published: 2019-07-18
Description: A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/flatCore/flatCore-CMS/compare/35fee64...de90af3; https://github.com/flatCore/flatCore-CMS/issues/39; https://github.com/flatCore/flatCore-CMS/compare/35fee64...de90af3
CVE: CVE-2019-13962
Published: 2019-07-18
Description: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html