rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-12133 
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-18T21:27:25.000Z
CVE-2019-12134 
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged user in a contact form field) that is mishandled in a CSV export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T13:27:44.000Z
CVE-2019-12135 
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-06T16:07:07.000Z
CVE-2019-12136 
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T02:55:45.000Z
CVE-2019-12137 
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T13:20:53.000Z
CVE-2019-12138 
MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T13:21:06.000Z
CVE-2019-12139 
An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-16T14:04:59.000Z
CVE-2019-12143 
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose WS_FTP usernames as well as filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:54:00.000Z
CVE-2019-12144 
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:55:50.000Z
CVE-2019-12145 
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using special patterns via the SCP protocol to disclose path names on the host operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:57:16.000Z
CVE-2019-12146 
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:58:26.000Z
CVE-2019-12147 
The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to the system (either via the web interface or via SSH) to achieve complete compromise of the device. This affects /var/webconfig/gui/Webconfig.inc.php and /usr/local/sng/bin/sng-user-mgmt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T15:47:35.000Z
CVE-2019-12148 
The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involving special characters in the username field. Upon successful exploitation, a remote unauthenticated user can login into the device's admin web portal without providing any credentials. This affects /var/webconfig/gui/Webconfig.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T15:20:37.000Z
CVE-2019-12149 
SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry module 2.1.x before 2.1.1 and 2.2.x before 2.2.1 allows attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T21:22:05.000Z
CVE-2019-12150 
Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T15:39:26.000Z
CVE-2019-12153 
Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:33:14.000Z
CVE-2019-12154 
XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:35:34.000Z
CVE-2019-12155 
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T15:33:11.000Z
CVE-2019-12156 
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:52:29.000Z
CVE-2019-12157 
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:51:36.000Z
CVE-2019-12158 
GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T18:06:23.000Z
CVE-2019-12159 
GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T18:06:33.000Z
CVE-2019-12160 
GoHTTP through 2017-07-25 has a sendHeader use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T18:06:43.000Z
CVE-2019-12161 
WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T18:47:33.000Z
CVE-2019-12162 
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-23T14:07:52.000Z
CVE-2019-12163 
GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersion request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T20:17:20.000Z
CVE-2019-12164 
ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-23T22:16:57.000Z
CVE-2019-12165 
MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and earlier, and 7.1 (7.1.0.57) and earlier and MiCollab AWV 6.3 (6.3.0.103), 6.2 (6.2.2.8), 6.1 (6.1.0.28), 6.0 (6.0.0.61), and 5.0 (5.0.5.7) have a Command Execution Vulnerability. Successful exploit of this vulnerability could allow an attacker to execute arbitrary system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-29T16:56:17.000Z
CVE-2019-12167 
httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T17:42:43.000Z
CVE-2019-12168 
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T21:31:21.000Z
CVE-2019-12169 
ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T20:00:28.000Z
CVE-2019-12170 
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T21:52:18.000Z
CVE-2019-12171 
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T12:44:11.000Z
CVE-2019-12172 
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T22:30:13.000Z
CVE-2019-12173 
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-17T22:30:23.000Z
CVE-2019-12174 
hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me_hide_vpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to escalate privileges, as well as obtain the ability to run any application on the system in the root context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-08T13:03:17.000Z
CVE-2019-12175 
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-17T16:40:14.000Z
CVE-2019-12176 
Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges to SYSTEM via reconfiguration of either service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T19:25:49.000Z
CVE-2019-12177 
Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate privileges via DLL hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-03T19:22:04.000Z
CVE-2019-12180 
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T16:06:44.000Z
CVE-2019-12181 
A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-17T15:16:26.000Z
CVE-2019-12182 
Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the administrative API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:11:13.000Z
CVE-2019-12183 
Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T15:12:05.000Z
CVE-2019-12184 
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-19T19:00:19.000Z
CVE-2019-12185 
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-19T23:05:41.000Z
CVE-2019-12186 
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-31T14:21:39.000Z
CVE-2019-12189 
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T17:30:14.000Z
CVE-2019-12190 
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-21T17:29:14.000Z
CVE-2019-12193 
H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T15:52:31.000Z
CVE-2019-12195 
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T15:24:45.000Z
CVE-2019-12196 
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-05T17:37:40.000Z
CVE-2019-12198 
In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T03:18:15.000Z
CVE-2019-12203 
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T18:45:44.000Z
CVE-2019-12204 
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T18:25:06.000Z
CVE-2019-12205 
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-25T18:51:31.000Z
CVE-2019-12206 
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T13:28:45.000Z
CVE-2019-12207 
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T13:28:56.000Z
CVE-2019-12208 
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T13:29:07.000Z
CVE-2019-12209 
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM configuration, part of the file contents of a symlink target will be logged, possibly revealing sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T20:26:55.000Z
CVE-2019-12210 
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-04T20:28:51.000Z
CVE-2019-12211 
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T15:05:02.000Z
CVE-2019-12212 
When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T15:05:15.000Z
CVE-2019-12213 
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T15:05:25.000Z
CVE-2019-12214 
In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c. The value of l_N_ppm comes from the file read in, and the code does not consider that l_N_ppm may be greater than the size of p_header_data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T15:05:34.000Z
CVE-2019-12215 
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T15:47:34.000Z
CVE-2019-12216 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:32:44.000Z
CVE-2019-12217 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:32:59.000Z
CVE-2019-12218 
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-20T16:33:13.000Z