rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-11020 
Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claim_files/claim_id_ URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-09T17:00:24.000Z
CVE-2019-11021 
admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-24T15:26:25.000Z
CVE-2019-11023 
The agroot() function in cgraph\obj.c in libcgraph.a in Graphviz 2.39.20160612.1140 has a NULL pointer dereference, as demonstrated by graphml2gv.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T22:20:09.000Z
CVE-2019-11024 
The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T22:20:19.000Z
CVE-2019-11025 
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T22:20:39.000Z
CVE-2019-11026 
FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T22:20:51.000Z
CVE-2019-11027 
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-10T18:57:09.000Z
CVE-2019-11028 
GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. This vulnerability is related to "uploadDocFile.aspx".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T13:09:08.000Z
CVE-2019-11029 
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:49:45.000Z
CVE-2019-11030 
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:51:12.000Z
CVE-2019-11031 
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T14:52:18.000Z
CVE-2019-11032 
In EasyToRecruit (E2R) before 2.11, the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-24T14:53:49.000Z
CVE-2019-11033 
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T14:56:59.000Z
CVE-2019-11034 Heap over-read in PHP EXIF extension
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: Found by OSS-Fuzz in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13723
Published: 2019-04-18T16:57:00.954Z
CVE-2019-11035 Heap over-read in PHP EXIF extension
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: Found by OSS-Fuzz in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13938
Published: 2019-04-18T16:57:00.996Z
CVE-2019-11036 Heap over-read in PHP EXIF extension
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: Discovered by OSS-fuzz in  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14050
Published: 2019-05-03T19:28:15.566Z
CVE-2019-11037 Out of bounds memory write in PHP Imagick extension
In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the address will be within the allocated array. This could lead to out of bounds write to memory if the function is called with the data controlled by untrusted party.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: PHP Group
product: PHP Imagick extension
Published: 2019-05-03T19:28:15.611Z
CVE-2019-11038 Uninitialized read in gdImageCreateFromXbm
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.
Problem types: cwe_id: CWE-457
description: CWE-457: Use of Uninitialized Variable
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: By chamal dot desilva at gmail dot com
Published: 2019-06-18T23:28:28.236Z
CVE-2019-11039 Out-of-bounds read in iconv.c
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: By maris dot adam at gmail dot com
Published: 2019-06-18T23:28:28.280Z
CVE-2019-11040 Heap buffer overflow in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: By orestiskourides at gmail dot com
Published: 2019-06-18T23:28:28.320Z
CVE-2019-11041 heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: By orestiskourides at gmail dot com
Published: 2019-08-09T19:26:34.152Z
CVE-2019-11042 heap-buffer-overflow on exif_process_user_comment in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
Credits: lang: en
value: By orestiskourides at gmail dot com
Published: 2019-08-09T19:26:34.193Z
CVE-2019-11043 Underflow in PHP-FPM can lead to RCE
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: PHP
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Reported by Emil Lerner.
Published: 2019-10-28T14:19:04.252Z
CVE-2019-11044 link() silently truncates after a null byte on Windows
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Problem types: cwe_id: CWE-170
description: CWE-170 Improper Null Termination
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Submitted by ryat at php.net
Published: 2019-12-23T02:40:16.742Z
CVE-2019-11045 DirectoryIterator class silently truncates after a null byte
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Problem types: cwe_id: CWE-170
description: CWE-170 Improper Null Termination
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Submitted by ryat at php.net
Published: 2019-12-23T02:40:17.130Z
CVE-2019-11046 Buffer underflow in bc_shift_addsub
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Submitted by thomas-josef dot riedmaier at siemens dot com
Published: 2019-12-23T02:40:17.526Z
CVE-2019-11047 Heap-buffer-overflow READ in exif
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19044
Published: 2019-12-23T02:40:17.978Z
CVE-2019-11048 Temporary files are not cleaned after OOM when parsing HTTP request data
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: jr at coredu dot mp
Published: 2020-05-20T07:15:15.636Z
CVE-2019-11049 mail() may release string with refcount==1 twice
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Submitted by Christoph M. Becker
Published: 2019-12-23T02:40:18.474Z
CVE-2019-11050 Use-after-free in exif parsing under memory sanitizer
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PHP Group
product: PHP
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: Submitted by Nikita Popov
Published: 2019-12-23T02:40:18.861Z
CVE-2019-11057 
SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T16:36:24.000Z
CVE-2019-11059 
Das U-Boot 2016.11-rc1 through 2019.04 mishandles the ext4 64-bit extension, resulting in a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-10T19:36:12.000Z
CVE-2019-11060 HG100 contains an Uncontrolled Resource Consumption vulnerability
The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time. CVSS 3.0 Base score 7.4 (Availability impacts). CVSS vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: ASUS
product: HG100 firmware
Published: 2019-08-29T00:19:45.655Z
CVE-2019-11061 HG100 has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Problem types: description: Boken Access Control
Affected products: vendor: ASUS
product: HG100 firmware
Credits: lang: en
value: timhuang
Published: 2019-08-29T00:18:59.682Z
CVE-2019-11062 SUNNET WMPro v5.0 and v5.1 has OS Command Injection
The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited without authentication.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: SUNNET
product: WMPro
Credits: lang: en
value: Tony Kuo
Published: 2019-07-11T18:22:06.876Z
CVE-2019-11063 SmartHome application has a broken access control vulnerability in its Web API Server
A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 (Confidentiality, Integrity and Availability impacts). CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Problem types: description: Boken Access Control
Affected products: vendor: ASUS
product: SmartHome Android app
vendor: ASUS
product: SmartHome ios app
Credits: lang: en
value: timhuang
Published: 2019-08-29T00:19:09.478Z
CVE-2019-11064 A vulnerability of remote credential disclosure was discovered in Advan VD-1
A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: AndroVideo
product: Advan VD-1 firmware
Credits: lang: en
value: Keniver Wang (CHT Security)
Published: 2019-08-29T00:19:17.490Z
CVE-2019-11065 
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-09T23:37:04.000Z
CVE-2019-11066 
openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-10T19:18:47.000Z
CVE-2019-11068 
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T19:38:18.000Z
CVE-2019-11069 
Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T00:00:00.000Z
CVE-2019-11070 
WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T20:15:06.000Z
CVE-2019-11071 
SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T20:36:43.000Z
CVE-2019-11072 
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states "The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T21:04:57.000Z