rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-14907 
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: Red Hat
product: samba
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2020-01-21T00:00:00.000Z
CVE-2019-14909 
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
Problem types: cwe_id: CWE-287
description: CWE-287
cwe_id: CWE-305
description: CWE-305
cwe_id: CWE-592
description: CWE-592
Affected products: vendor: n/a
product: Keycloak
Published: 2019-12-04T14:34:06.000Z
CVE-2019-14910 
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
Problem types: cwe_id: CWE-287
description: CWE-287
cwe_id: CWE-305
description: CWE-305
cwe_id: CWE-592
description: CWE-592
Affected products: vendor: n/a
product: Keycloak
Published: 2019-12-05T14:16:00.000Z
CVE-2019-14911 
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:37:37.000Z
CVE-2019-14912 
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:38:15.000Z
CVE-2019-14913 
An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:38:48.000Z
CVE-2019-14914 
An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:39:25.000Z
CVE-2019-14915 
An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:39:54.000Z
CVE-2019-14916 
An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T13:40:18.000Z
CVE-2019-14918 
XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T16:18:22.000Z
CVE-2019-14919 
An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials into a shell, gaining root execution privileges over the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T16:22:43.000Z
CVE-2019-14920 
Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/system_command.asp shell feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T16:24:46.000Z
CVE-2019-14923 
EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-16T12:22:58.000Z
CVE-2019-14924 
An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-10T18:34:17.000Z
CVE-2019-14925 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init/settings.xml configuration file on the file system allows an attacker to read sensitive configuration settings such as usernames, passwords, and other sensitive RTU data due to insecure permission assignment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:12:34.000Z
CVE-2019-14926 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:10:13.000Z
CVE-2019-14927 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file (which contains data such as usernames, passwords, and other sensitive RTU data).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:08:22.000Z
CVE-2019-14928 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:09:14.000Z
CVE-2019-14929 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:11:44.000Z
CVE-2019-14930 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:10:55.000Z
CVE-2019-14931 
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T12:07:23.000Z
CVE-2019-14932 
The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modified selApp variable to personalData/resumeDetail.cfm. This includes personal information and other sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T12:46:28.000Z
CVE-2019-14933 
Bagisto 0.1.5 allows CSRF under /admin URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-11T20:56:09.000Z
CVE-2019-14934 
An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-11T21:28:22.000Z
CVE-2019-14935 
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-11T23:03:43.000Z
CVE-2019-14936 
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-11T18:01:27.000Z
CVE-2019-14937 
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-17T16:15:20.000Z
CVE-2019-14939 
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T00:51:33.000Z
CVE-2019-14940 
In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T01:36:19.000Z
CVE-2019-14941 
SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T16:08:24.000Z
CVE-2019-14942 
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2019-14943 
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T11:58:32.000Z
CVE-2019-14944 
An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2019-14945 
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:29:32.000Z
CVE-2019-14946 
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:29:05.000Z
CVE-2019-14947 
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:27:56.000Z
CVE-2019-14948 
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T14:57:52.000Z
CVE-2019-14949 
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T14:56:59.000Z
CVE-2019-14950 
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T14:50:49.000Z
CVE-2019-14951 
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T15:15:51.000Z
CVE-2019-14952 
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T13:24:20.000Z
CVE-2019-14953 
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:48:39.000Z
CVE-2019-14954 
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T13:22:24.000Z
CVE-2019-14955 
In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:50:27.000Z
CVE-2019-14956 
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:41:19.000Z
CVE-2019-14957 
The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:39:44.000Z
CVE-2019-14958 
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a remote invocation of an OOM error message because of Uncontrolled Memory Allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:40:23.000Z
CVE-2019-14959 
JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-02T18:37:57.000Z
CVE-2019-14960 
JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T15:51:55.000Z
CVE-2019-14961 
JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-01T16:43:04.000Z
CVE-2019-14965 
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T17:21:58.000Z
CVE-2019-14966 
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T17:21:44.000Z
CVE-2019-14967 
An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T17:21:30.000Z
CVE-2019-14968 
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T17:56:01.000Z
CVE-2019-14969 
Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.ADA.StorageAuditService (which writes to that directory) does not perform proper impersonation, and thus the target file will have the same permissions as the invoking process (in this case, granting Authenticated Users full access over the target file). This vulnerability can be triggered by a low-privileged user to perform DLL Hijacking/Binary Planting attacks and ultimately execute code as NT AUTHORITY\SYSTEM with the help of Symbolic Links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T18:17:59.000Z
CVE-2019-14970 
A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:55:11.000Z
CVE-2019-14973 
_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T05:15:29.000Z
CVE-2019-14974 
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T15:44:12.000Z
CVE-2019-14975 
Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-14T12:46:26.000Z
CVE-2019-14976 
iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T21:05:00.000Z
CVE-2019-14978 
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:23:41.000Z
CVE-2019-14979 
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-29T18:26:37.000Z
CVE-2019-14980 
In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T22:06:35.000Z
CVE-2019-14981 
In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T22:06:50.000Z
CVE-2019-14982 
In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-12T22:07:00.000Z
CVE-2019-14984 
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T19:15:17.000Z
CVE-2019-14985 
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T19:17:52.000Z
CVE-2019-14986 
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T19:19:44.000Z
CVE-2019-14987 
Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T03:38:15.000Z
CVE-2019-14993 
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-13T17:38:39.000Z