rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-17440 PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access
Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. This issue does not affect PAN-OS 8.1 or prior releases. This issue only affected a very limited number of customers and we undertook individual outreach to help them upgrade. At the time of publication, all identified customers have upgraded SW or content and are not impacted.
Problem types: cwe_id: CWE-923
description: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
Affected products: vendor: Palo Alto Networks
product: PAN-OS
vendor: Palo Alto Networks
product: PAN-OS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Palo Alto Networks would like to thank Ayad (Ed) Sleiman, Head of Information Security at King Abdullah University of Science and Technology (KAUST) and his team for discovering and responsibly reporting this issue.
Published: 2019-12-20T15:22:18.040Z
CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0.
Problem types: cwe_id: CWE-521
description: CWE-521: Weak Password Requirements
Affected products: vendor: Jfrog
product: Artifactory
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Daniel Shapira of Palo Alto Networks.
Published: 2020-10-12T21:55:55.271Z
CVE-2019-17445 
An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be forced to copy files from the filesystem to other locations via Symbolic Link Following.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T17:18:38.000Z
CVE-2019-17446 
An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T17:36:00.000Z
CVE-2019-17449 
Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it would require at least administrator privileges and would gain only SYSTEM privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:58:49.000Z
CVE-2019-17450 
find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:21:02.000Z
CVE-2019-17451 
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:20:50.000Z
CVE-2019-17452 
Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::InspectFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:46:16.000Z
CVE-2019-17453 
Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::WriteFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4encrypt or mp4compact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:46:04.000Z
CVE-2019-17454 
Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4_StsdAtom::GetSampleDescription in Core/Ap4StsdAtom.cpp, as demonstrated by mp4info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:45:54.000Z
CVE-2019-17455 
Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T17:17:48.000Z
CVE-2019-17488 
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:18:00.000Z
CVE-2019-17489 
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:17:33.000Z
CVE-2019-17490 
app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by PHP code (with a .php filename but the image/png content type) to the web/polygon/problem/tests URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:17:23.000Z
CVE-2019-17491 
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web/polygon/problem/update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:17:15.000Z
CVE-2019-17493 
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or web/polygon/problem/update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:16:54.000Z
CVE-2019-17494 
laravel-bjyblog 6.1.1 has XSS via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T20:16:42.000Z
CVE-2019-17495 
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T21:04:49.000Z
CVE-2019-17496 
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T23:32:55.000Z
CVE-2019-17497 
Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T23:52:06.000Z
CVE-2019-17498 
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T00:00:00.000Z
CVE-2019-17499 
The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the Target_IP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:05:15.000Z
CVE-2019-17501 
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-14T01:12:09.000Z
CVE-2019-17502 
Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The process_header_end() function calls boa_atoi(), which ultimately calls atoi() on a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T19:53:12.000Z
CVE-2019-17503 
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T16:21:11.000Z
CVE-2019-17504 
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. A reflected Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T16:21:01.000Z
CVE-2019-17505 
D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:28:39.000Z
CVE-2019-17506 
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:29:43.000Z
CVE-2019-17507 
An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dir_login.asp"' line in a .asp file. This provides access to d_status.asp, version.asp, d_dhcptbl.asp, and d_acl.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:29:32.000Z
CVE-2019-17508 
On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:29:17.000Z
CVE-2019-17509 
D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:29:04.000Z
CVE-2019-17510 
D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T19:28:54.000Z
CVE-2019-17511 
There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via log_get.php, which could be used to discover the intranet network structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-14T15:01:29.000Z
CVE-2019-17512 
There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to log_clear.php, which could be used to erase attack traces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T18:32:41.000Z
CVE-2019-17513 
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-18T02:36:25.000Z
CVE-2019-17514 
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T12:07:23.000Z
CVE-2019-17515 
The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T20:08:30.000Z
CVE-2019-17517 
The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length, allowing attackers in radio range to cause a buffer overflow via a crafted Link Layer packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:18:55.000Z
CVE-2019-17518 
The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload length larger than expected, allowing attackers in radio range to cause a buffer overflow via a crafted packet. This affects, for example, August Smart Lock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:22:14.000Z
CVE-2019-17519 
The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T18:04:08.000Z
CVE-2019-17520 
The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T20:26:43.000Z
CVE-2019-17521 
An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T17:44:22.000Z
CVE-2019-17522 
A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T17:44:10.000Z
CVE-2019-17523 
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T14:37:36.000Z
CVE-2019-17524 
An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-13T14:36:01.000Z
CVE-2019-17525 
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T18:57:50.000Z
CVE-2019-17526 
An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').popen('whoami').read() line. NOTE: the vendor's position is that the product is "vulnerable by design" and the current behavior will be retained
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-18T16:15:08.000Z
CVE-2019-17527 
dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-19T20:41:07.000Z
CVE-2019-17528 
An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom::SetDefaultSampleSize at Core/Ap4TfhdAtom.h when called from AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T19:21:49.000Z
CVE-2019-17529 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T19:21:41.000Z
CVE-2019-17530 
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T19:21:29.000Z
CVE-2019-17531 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T20:07:34.000Z
CVE-2019-17532 
An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rules-processing outage) via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-12T20:23:59.000Z
CVE-2019-17533 
Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T02:00:33.000Z
CVE-2019-17534 
vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T01:59:34.000Z
CVE-2019-17535 
Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T17:52:21.000Z
CVE-2019-17536 
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T17:52:39.000Z
CVE-2019-17537 
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T18:08:36.000Z
CVE-2019-17538 
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-13T18:08:27.000Z
CVE-2019-17539 
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-14T01:09:40.000Z