rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-18991 
A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285 1.0.0.12NA devices. The vulnerability allows sending an unencrypted data frame to a WPA2-protected WLAN router where the packet is routed through the network. If successful, a response is sent back as an encrypted frame, which would allow an attacker to discern information or potentially modify data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T17:30:29.000Z
CVE-2019-18992 
OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" (this can occur, for example, on a TP-Link Archer C7 device).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-03T19:32:09.000Z
CVE-2019-18993 
OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, for example, on a TP-Link Archer C7 device).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-03T19:29:01.000Z
CVE-2019-18994 ABB PB610 HMIStudio crashes after launching an empty *.JPR application file
Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ABB
product: ABB PB610 Panel Builder 600
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: NSFOCUS for providing vulnerability details and proof of concept.
Published: 2019-12-18T20:20:57.000Z
CVE-2019-18995 ABB PB610 HMISimulator does not check content-length of the HTTP request
The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ABB
product: PB610 Panel Builder 600
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: NSFOCUS for providing vulnerability details and proof of concept.
Published: 2019-12-18T20:19:34.000Z
CVE-2019-18996 ABB PB610 HMIStudio accepts malicious DLL file in an application
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.
Problem types: cwe_id: CWE-424
description: CWE-424 Improper Protection of Alternate Path
Affected products: vendor: ABB
product: PB610 Panel Builder 600
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: NSFOCUS for providing vulnerability details and proof of concept.
Published: 2019-12-18T20:24:44.000Z
CVE-2019-18997 PB610 HMISimulator provides interface with access to arbitrary files
The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working directory, thus potentially supporting unauthorized file access.
Problem types: cwe_id: CWE-424
description: CWE-424 Improper Protection of Alternate Path
Affected products: vendor: ABB
product: PB610 Panel Builder 600
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: NSFOCUS for providing vulnerability details and proof of concept.
Published: 2019-12-18T20:22:47.000Z
CVE-2019-18998 Asset Suite Direct Object Reference Access
Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: ABB
product: Asset Suite
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2020-02-17T18:40:38.000Z
CVE-2019-19000 eSOMS Cachecontrol (Pragma) HTTP Header
For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information.
Problem types: cwe_id: CWE-16
description: CWE-16 Configuration
cwe_id: CWE-202
description: CWE-202 Exposure of Sensitive Data Through Data Queries
Affected products: vendor: ABB
product: eSOMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2020-04-02T19:49:35.000Z
CVE-2019-19001 eSOMS X-FrameOption
For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentials.
Problem types: cwe_id: CWE-16
description: CWE-16 Configuration
Affected products: vendor: ABB
product: eSOMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-04-02T19:49:55.000Z
CVE-2019-19002 ABB eSOMS X-XSS-Protection not enabled
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.
Problem types: cwe_id: CWE-16
description: CWE-16 Configuration
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ABB
product: eSOMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2020-04-02T19:50:02.000Z
CVE-2019-19003 ABB eSOMS: HTTPOnly flag not set
For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.
Problem types: cwe_id: CWE-16
description: CWE-16 Configuration
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ABB
product: eSOMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-04-02T19:46:29.000Z
CVE-2019-19004 
A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-11T20:08:15.000Z
CVE-2019-19005 
A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-11T20:08:30.000Z
CVE-2019-19006 
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T17:51:14.000Z
CVE-2019-19007 
Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a related issue to CVE-2019-17600.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-05T15:28:42.000Z
CVE-2019-19010 
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-16T00:52:06.000Z
CVE-2019-19011 
MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIndexToTrueColor in ngiflib.c via a file that lacks a palette.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-16T15:01:56.000Z
CVE-2019-19012 
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-16T15:30:47.000Z
CVE-2019-19013 
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T15:55:19.000Z
CVE-2019-19014 
An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root privileges by an attacker with access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:46:21.000Z
CVE-2019-19015 
An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal PostgreSQL database of the appliance. By connecting to the database through the proxy (without password authentication), an attacker is able to fully control the appliance database. Through this, several different paths exist to gain further access, or execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:47:28.000Z
CVE-2019-19016 
An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injection through the results parameter. This could be used by an attacker to extract sensitive information from the appliance database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:48:44.000Z
CVE-2019-19017 
An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this to gain root privileges on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:49:57.000Z
CVE-2019-19018 
An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web administration interface, revealing what database the web application is using.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:52:47.000Z
CVE-2019-19019 
An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root. The issue stems from the hotfix download mechanism, which downloads a shell script via HTTP, and then executes it as root. This is analogous to CVE-2019-6800 but for a different product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:53:18.000Z
CVE-2019-19020 
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:54:40.000Z
CVE-2019-19021 
An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with administrator privileges. Anybody can log in with this account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-02T16:55:35.000Z
CVE-2019-19022 
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-17T10:59:09.000Z
CVE-2019-19023 
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T02:22:41.000Z
CVE-2019-19025 
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T02:01:41.000Z
CVE-2019-19026 
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T02:01:55.000Z
CVE-2019-19029 
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T02:02:28.000Z
CVE-2019-19030 
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2019-19031 
Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and DoS by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T19:12:24.000Z
CVE-2019-19032 
XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-30T19:15:30.000Z
CVE-2019-19033 
Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any username and the hardcoded dev password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T17:53:02.000Z
CVE-2019-19034 
Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T16:09:54.000Z
CVE-2019-19035 
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-17T15:52:09.000Z
CVE-2019-19036 
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T02:00:18.000Z
CVE-2019-19037 
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T02:11:59.000Z
CVE-2019-19039 
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-21T01:40:53.000Z
CVE-2019-19040 
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-17T20:20:50.000Z
CVE-2019-19041 
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by the underlying system. It is possible to achieve this by modifying the values in the files.SUM file (which are used for integrity control) and injecting malicious code into the upgrade.sh file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-17T20:52:34.000Z
CVE-2019-19043 
A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:37.000Z
CVE-2019-19044 
Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering kcalloc() or v3d_job_init() failures, aka CID-29cd13cfd762.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:39.000Z
CVE-2019-19045 
A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:40.000Z
CVE-2019-19046 
A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:42.000Z
CVE-2019-19047 
A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:43.000Z
CVE-2019-19048 
A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:44.000Z
CVE-2019-19049 
A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:46.000Z
CVE-2019-19050 
A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T05:23:47.000Z