stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2017-1000110 (severity: MEDIUM, weakness: CWE-287)
Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.
CVE-2017-1000111 (severity: HIGH, weakness: CWE-787)
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.
CVE-2017-1000112 (severity: HIGH, weakness: CWE-362)
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
CVE-2017-1000113 (severity: MEDIUM, weakness: CWE-200)
The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with Credentials Plugin to store passwords securely, and automatically migrates existing passwords.
CVE-2017-1000114 (severity: LOW, weakness: CWE-200)
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.
CVE-2017-1000115 (severity: HIGH, weakness: CWE-59)
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
CVE-2017-1000116 (severity: CRITICAL, weakness: CWE-78)
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
CVE-2017-1000117 (severity: HIGH, weakness: CWE-601)
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVE-2017-1000118 (severity: HIGH, weakness: CWE-119)
Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
CVE-2017-1000119 (severity: HIGH, weakness: CWE-434)
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
CVE-2017-1000120 (severity: HIGH, weakness: CWE-89)
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
CVE-2017-1000121 (severity: CRITICAL, weakness: CWE-190)
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.
CVE-2017-1000122 (severity: MEDIUM, weakness: CWE-20)
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.
CVE-2017-1000125 (severity: HIGH, weakness: CWE-732)
Codiad(full version) is vulnerable to write anything to configure file in the installation resulting upload a webshell.
CVE-2017-1000126 (severity: MEDIUM, weakness: CWE-125)
exiv2 0.26 contains a Stack out of bounds read in webp parser
CVE-2017-1000127 (severity: MEDIUM, weakness: CWE-119)
Exiv2 0.26 contains a heap buffer overflow in tiff parser
CVE-2017-1000128 (severity: MEDIUM, weakness: CWE-125)
Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
CVE-2017-1000129 (severity: HIGH, weakness: CWE-89)
Serendipity 2.0.3 is vulnerable to a SQL injection in the blog component resulting in information disclosure
CVE-2017-1000131 (severity: MEDIUM, weakness: CWE-613)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions.
CVE-2017-1000132 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have its code executed when a user tries to download the file.
CVE-2017-1000133 (severity: HIGH, weakness: CWE-200)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts to be included in a Leap2a export of their own pages.
CVE-2017-1000134 (severity: HIGH, weakness: CWE-732)
Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them.
CVE-2017-1000135 (severity: MEDIUM, weakness: CWE-613)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the institution they belong to is suspended.
CVE-2017-1000136 (severity: MEDIUM, weakness: CWE-613)
Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change.
CVE-2017-1000137 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop).
CVE-2017-1000138 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when dragging/dropping files into a collection if the file has Javascript code in its title.
CVE-2017-1000139 (severity: HIGH, weakness: CWE-918)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
CVE-2017-1000140 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file.
CVE-2017-1000141 (severity: MEDIUM, weakness: CWE-640)
An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
CVE-2017-1000142 (severity: MEDIUM, weakness: NVD-CWE-Other)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation.
CVE-2017-1000143 (severity: MEDIUM, weakness: CWE-200)
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users receiving watchlist notifications about pages they do not have access to anymore.
CVE-2017-1000144 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages.
CVE-2017-1000145 (severity: MEDIUM, weakness: NVD-CWE-Other)
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments.
CVE-2017-1000146 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages.
CVE-2017-1000147 (severity: MEDIUM, weakness: CWE-352)
Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.
CVE-2017-1000148 (severity: HIGH, weakness: CWE-502)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.
CVE-2017-1000149 (severity: MEDIUM, weakness: CWE-79)
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open())
CVE-2017-1000150 (severity: HIGH, weakness: CWE-384)
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.
CVE-2017-1000151 (severity: HIGH, weakness: CWE-200)
Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log.
CVE-2017-1000152 (severity: CRITICAL, weakness: NVD-CWE-Other)
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.
CVE-2017-1000153 (severity: CRITICAL, weakness: CWE-732)
Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.
CVE-2017-1000154 (severity: CRITICAL, weakness: CWE-287)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended.
CVE-2017-1000155 (severity: MEDIUM, weakness: CWE-200)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to profile pictures being accessed without any access control checks consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not they were currently selected as the "default" or used in any pages.
CVE-2017-1000156 (severity: MEDIUM, weakness: CWE-269)
Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role.
CVE-2017-1000157 (severity: MEDIUM, weakness: CWE-200)
Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on.
CVE-2017-1000158 (severity: CRITICAL, weakness: CWE-190)
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
CVE-2017-1000159 (severity: HIGH, weakness: CWE-78)
Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.
CVE-2017-1000160 (severity: MEDIUM, weakness: CWE-79)
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
CVE-2017-1000163 (severity: MEDIUM, weakness: CWE-601)
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
CVE-2017-1000164 (severity: MEDIUM, weakness: CWE-79)
Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation
CVE-2017-1000168 (severity: MEDIUM, weakness: NVD-CWE-Other)
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
CVE-2017-1000169 (severity: CRITICAL, weakness: CWE-20)
QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takeover of the server hosting QuickerBB.
CVE-2017-1000170 (severity: HIGH, weakness: CWE-22)
jqueryFileTree 2.1.5 and older Directory Traversal
CVE-2017-1000171 (severity: CRITICAL, weakness: CWE-532)
Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.
CVE-2017-1000172 (severity: CRITICAL, weakness: CWE-416)
Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has been freed. Line 542 of gravity_lexer.c. 'lexer' is being used to access a variable but 'lexer' has already been freed, creating a Heap Use-After-Free condition.
CVE-2017-1000173 (severity: CRITICAL, weakness: CWE-125)
Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. By creating a large loop whiling pushing data to a buffer, we can break out of the bounds checking of that buffer. When list.join is called on the data it will read past a buffer resulting in a Heap-Buffer-Overflow.
CVE-2017-1000174 (severity: MEDIUM, weakness: CWE-119)
In SWFTools, an address access exception was found in swfdump swf_GetBits().
CVE-2017-1000176 (severity: MEDIUM, weakness: CWE-119)
In SWFTools, a memcpy buffer overflow was found in swfc.
CVE-2017-1000182 (severity: MEDIUM, weakness: CWE-772)
In SWFTools, a memory leak was found in wav2swf.
CVE-2017-1000185 (severity: MEDIUM, weakness: CWE-119)
In SWFTools, a memcpy buffer overflow was found in gif2swf.
CVE-2017-1000186 (severity: MEDIUM, weakness: CWE-119)
In SWFTools, a stack overflow was found in pdf2swf.
CVE-2017-1000187 (severity: HIGH, weakness: CWE-119)
In SWFTools, an address access exception was found in pdf2swf. FoFiTrueType::writeTTF()
CVE-2017-1000188 (severity: MEDIUM, weakness: CWE-79)
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
CVE-2017-1000189 (severity: HIGH, weakness: CWE-20)
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
CVE-2017-1000190 (severity: CRITICAL, weakness: CWE-611)
SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.
CVE-2017-1000191 (severity: HIGH, weakness: CWE-400)
Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS.
CVE-2017-1000192 (severity: CRITICAL, weakness: NVD-CWE-Other)
Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information.
CVE-2017-1000193 (severity: MEDIUM, weakness: CWE-79)
October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.
CVE-2017-1000194 (severity: CRITICAL, weakness: CWE-434)
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.
CVE-2017-1000195 (severity: HIGH, weakness: CWE-502)
October CMS build 412 is vulnerable to PHP object injection in asset move functionality resulting in ability to delete files limited by file permissions on the server.
CVE-2017-1000196 (severity: CRITICAL, weakness: CWE-94)
October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server.
CVE-2017-1000197 (severity: CRITICAL, weakness: CWE-417)
October CMS build 412 is vulnerable to file path modification in asset move functionality resulting in creating creating malicious files on the server.
CVE-2017-1000198 (severity: HIGH, weakness: CWE-119)
tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service
CVE-2017-1000199 (severity: HIGH, weakness: CWE-200)
tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.
CVE-2017-10002 (severity: MEDIUM, weakness: NVD-CWE-Other)
Vulnerability in the Oracle Hospitality Inventory Management component of Oracle Hospitality Applications (subcomponent: Settings and Config). Supported versions that are affected are 8.5.1 and 9.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality Inventory Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality Inventory Management accessible data as well as unauthorized read access to a subset of Oracle Hospitality Inventory Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVE-2017-1000200 (severity: HIGH, weakness: CWE-476)
tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service
CVE-2017-1000201 (severity: MEDIUM, weakness: CWE-20)
The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack
CVE-2017-1000203 (severity: HIGH, weakness: CWE-78)
ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution
CVE-2017-1000206 (severity: CRITICAL, weakness: CWE-119)
samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in potential arbitrary code execution
CVE-2017-1000207 (severity: HIGH, weakness: CWE-502)
A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
CVE-2017-1000208 (severity: HIGH, weakness: CWE-502)
A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
CVE-2017-1000209 (severity: MEDIUM, weakness: CWE-295)
The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.
CVE-2017-1000210 (severity: CRITICAL, weakness: CWE-119)
picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer overflow resulting in code execution or denial of service attack
CVE-2017-1000211 (severity: MEDIUM, weakness: CWE-416)
Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.
CVE-2017-1000212 (severity: CRITICAL, weakness: NVD-CWE-Other)
Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.
CVE-2017-1000213 (severity: MEDIUM, weakness: CWE-79)
WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
CVE-2017-1000214 (severity: CRITICAL, weakness: CWE-78)
GitPHP by xiphux is vulnerable to OS Command Injections
CVE-2017-1000215 (severity: CRITICAL, weakness: CWE-78)
ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution
CVE-2017-1000217 (severity: HIGH, weakness: CWE-74)
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
CVE-2017-1000218 (severity: CRITICAL, weakness: CWE-119)
LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code execution.
CVE-2017-1000219 (severity: CRITICAL, weakness: CWE-78)
npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user