rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-8988 TIBCO Spotfire Data Science Privilege Escalation Vulnerability
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected system, in a way that may allow for data modifications and deletions that should be denied. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a malicious actor could modify or delete data on the system that they should not be able to change, affecting the output that others might see.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Data Science for AWS
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Data Science
Published: 2019-03-26T17:54:12.315Z
CVE-2019-8989 TIBCO Spotfire Data Science Spoofing Vulnerability
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a user of the system could temporarily fool another user of the system into believing they were someone else.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Data Science for AWS
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Data Science
Published: 2019-03-26T17:54:12.353Z
CVE-2019-8990 TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
Problem types: description: The impact of this vulnerability includes the possibility of a malicious HTTP client successfully executing HTTP requests without authenticating. This possibility is restricted to circumstances where HTTP basic authentication is used in conjunction with an XML Authentication resource.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BusinessWorks
Published: 2019-04-09T17:37:10.700Z
CVE-2019-8991 TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities
The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains multiple vulnerabilities that may allow for cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that an unprivileged remote attacker could gain full access to all the capabilities of the web interface of the TIBCO ActiveMatrix Administrator.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Policy Director
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Bus
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Grid
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
Credits: lang: en
value: TIBCO would like to extend its appreciation to Giulio Comi and Flavio Baldassi of Horizon Security for discovery of these vulnerabilities.
Published: 2019-04-24T20:20:12.373Z
CVE-2019-8992 TIBCO Active Matrix Service Grid Administrator Remote Code Execution
The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability wherein a user without privileges to upload distributed application archives ("Upload DAA" permission) can theoretically upload arbitrary code, and in some circumstances then execute that code on ActiveMatrix Service Grid nodes. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a user without privileges to upload code could execute arbitrary code on ActiveMatrix Service Grid nodes.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Policy Director
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Bus
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Grid
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
Published: 2019-04-24T20:20:12.415Z
CVE-2019-8993 TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File
The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that credentials could be disclosed.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Policy Director
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Bus
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Grid
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
Published: 2019-04-24T20:20:12.457Z
CVE-2019-8994 TIBCO ActiveMatrix BPM Escalation of Privileges Vulnerability
The workspace client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contains vulnerabilities where an authenticated user can change settings that can theoretically adversely impact other users. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an authenticated user could trick other users of the system into visiting malicious web sites.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
Published: 2019-04-24T20:20:12.494Z
CVE-2019-8995 TIBCO ActiveMatrix BPM Open Redirect Vulnerability
The workspace client, openspace client, and app development client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain a vulnerability wherein a malicious URL could trick a user into visiting a website of the attacker's choice. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a user could be tricked into visiting a malicious website.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
product: TIBCO Silver Fabric Enabler for ActiveMatrix BPM
Published: 2019-04-24T20:20:12.532Z
CVE-2019-8996 
In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-21T00:00:00.000Z
CVE-2019-8997 
An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field.
Problem types: description: XML External Entity Injection (XXE)
Affected products: vendor: n/a
product: BlackBerry AtHoc
Published: 2019-03-21T17:12:15.000Z
CVE-2019-8998 
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space.
Problem types: description: Information disclosure leading to a potential local escalation of privilege
cwe_id: CWE-413
description: CWE-413 Improper Resource Locking
Affected products: vendor: BlackBerry
product: QNX Software Development Platform (QNX SDP)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2019-07-12T15:30:28.000Z
CVE-2019-8999 
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
Problem types: description: XML External Entity
Affected products: vendor: n/a
product: BlackBerry UEM
Published: 2019-04-18T16:51:41.000Z
CVE-2019-9002 
An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the database_host parameter if the installer remains present in its original directory after installation is completed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T06:00:00.000Z
CVE-2019-9003 
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T15:00:00.000Z
CVE-2019-9004 
In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking (wasting) 24 bytes of memory. This can lead to termination of the LWM2M server after exhausting all available memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T15:00:00.000Z
CVE-2019-9005 
The Cprime Power Scripts app before 4.0.14 for Atlassian Jira allows Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-18T18:00:02.000Z
CVE-2019-9008 
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-17T13:15:32.000Z
CVE-2019-9009 
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-17T15:34:42.000Z
CVE-2019-9010 
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T17:44:42.000Z
CVE-2019-9011 
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2019-9012 
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T17:47:31.000Z
CVE-2019-9013 
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-15T16:08:31.000Z
CVE-2019-9015 
A Path Traversal vulnerability was discovered in MOPCMS through 2018-11-30, leading to deletion of unexpected critical files. The exploitation point is in the "column management" function. The path added to the column is not verified. When a column is deleted by an attacker, the corresponding directory is deleted, as demonstrated by ./ to delete the entire web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T16:00:00.000Z
CVE-2019-9016 
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&ac=add&menuid=29 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T16:00:00.000Z
CVE-2019-9017 
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-02T18:54:00.000Z
CVE-2019-9019 
The British Airways Entertainment System, as installed on Boeing 777-36N(ER) and possibly other aircraft, does not prevent the USB charging/data-transfer feature from interacting with USB keyboard and mouse devices, which allows physically proximate attackers to conduct unanticipated attacks against Entertainment applications, as demonstrated by using mouse copy-and-paste actions to trigger a Chat buffer overflow or possibly have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T20:00:00.000Z
CVE-2019-9020 
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9021 
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9022 
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9023 
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9024 
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9025 
An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-22T23:00:00.000Z
CVE-2019-9026 
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function InflateVarName() in inflate.c when called from ReadNextCell in mat5.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T12:00:00.000Z
CVE-2019-9027 
An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow problem in the function ReadNextCell() in mat5.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-23T12:00:00.000Z