stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2018-11096 (severity: MEDIUM, weakness: CWE-352)
Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the target's account information remotely.
CVE-2018-11097 (severity: HIGH, weakness: CWE-772)
An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.
CVE-2018-11098 (severity: HIGH, weakness: CWE-434)
An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.
CVE-2018-11099 (severity: MEDIUM, weakness: CWE-125)
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.
CVE-2018-1110 (severity: HIGH, weakness: CWE-20)
A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.
CVE-2018-11100 (severity: HIGH, weakness: CWE-119)
The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.
CVE-2018-11101 (severity: MEDIUM, weakness: CWE-79)
Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn't matter).
CVE-2018-11102 (severity: HIGH, weakness: CWE-119)
An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
CVE-2018-11105 (severity: MEDIUM, weakness: CWE-79)
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.
CVE-2018-11106 (severity: CRITICAL, weakness: CWE-77)
NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.
CVE-2018-1111 (severity: HIGH, weakness: CWE-77)
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
CVE-2018-11116 (severity: HIGH, weakness: CWE-732)
OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i.e., achieve ubus access over HTTP) that were only supposed to be accessible to a specific user, as demonstrated by the file, log, and service namespaces, potentially leading to remote Information Disclosure or Code Execution. NOTE: The developer disputes this as a vulnerability, indicating that rpcd functions appropriately
CVE-2018-11117 (severity: MEDIUM, weakness: CWE-79)
Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute.
CVE-2018-11118 (severity: MEDIUM, weakness: CWE-79)
The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php.
CVE-2018-11119 (severity: MEDIUM, weakness: CWE-601)
ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter.
CVE-2018-1112 (severity: HIGH, weakness: CWE-287)
glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.
CVE-2018-11120 (severity: MEDIUM, weakness: CWE-79)
Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.
CVE-2018-11124 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.
CVE-2018-11126 (severity: HIGH, weakness: CWE-352)
dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.
CVE-2018-11127 (severity: MEDIUM, weakness: CWE-352)
e107 2.1.7 has CSRF resulting in arbitrary user deletion.
CVE-2018-11128 (severity: HIGH, weakness: CWE-787)
The ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly execute arbitrary code via a crafted pdf file.
CVE-2018-11129 (severity: HIGH, weakness: CWE-416)
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
CVE-2018-1113 (severity: MEDIUM, weakness: CWE-285)
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.
CVE-2018-11130 (severity: HIGH, weakness: CWE-416)
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.
CVE-2018-11132 (severity: HIGH, weakness: CWE-78)
In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.
CVE-2018-11133 (severity: MEDIUM, weakness: CWE-79)
The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting.
CVE-2018-11134 (severity: HIGH, weakness: CWE-640)
In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.
CVE-2018-11135 (severity: HIGH, weakness: CWE-1321)
The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attacks.
CVE-2018-11136 (severity: CRITICAL, weakness: CWE-89)
The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).
CVE-2018-11137 (severity: MEDIUM, weakness: CWE-22)
The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary files with 'www' privileges via Directory Traversal. No administrator privileges are needed to execute this script.
CVE-2018-11138 (severity: CRITICAL, weakness: CWE-78)
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVE-2018-11139 (severity: HIGH, weakness: CWE-78)
The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method.
CVE-2018-1114 (severity: MEDIUM, weakness: CWE-400)
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
CVE-2018-11140 (severity: CRITICAL, weakness: CWE-89)
The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, an error-based type).
CVE-2018-11141 (severity: CRITICAL, weakness: CWE-22)
The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318 can be abused to write and delete files respectively via Directory Traversal. Files can be at any location where the 'www' user has write permissions.
CVE-2018-11142 (severity: MEDIUM, weakness: CWE-863)
The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from localhost. This restriction can be bypassed by modifying the 'Host' and 'X_Forwarded_For' HTTP headers in a POST request. An anonymous user can abuse this vulnerability to execute critical functions without authorization.
CVE-2018-11143 (severity: CRITICAL, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
CVE-2018-11144 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
CVE-2018-11145 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
CVE-2018-11146 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
CVE-2018-11147 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
CVE-2018-11148 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
CVE-2018-11149 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
CVE-2018-1115 (severity: MEDIUM, weakness: CWE-732)
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.
CVE-2018-11150 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
CVE-2018-11151 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
CVE-2018-11152 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
CVE-2018-11153 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
CVE-2018-11154 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
CVE-2018-11155 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
CVE-2018-11156 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
CVE-2018-11157 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
CVE-2018-11158 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
CVE-2018-11159 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
CVE-2018-1116 (severity: MEDIUM, weakness: CWE-285)
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
CVE-2018-11160 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
CVE-2018-11161 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
CVE-2018-11162 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
CVE-2018-11163 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
CVE-2018-11164 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
CVE-2018-11165 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
CVE-2018-11166 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
CVE-2018-11167 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
CVE-2018-11168 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
CVE-2018-11169 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
CVE-2018-1117 (severity: CRITICAL, weakness: CWE-532)
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.
CVE-2018-11170 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
CVE-2018-11171 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
CVE-2018-11172 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
CVE-2018-11173 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
CVE-2018-11174 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
CVE-2018-11175 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
CVE-2018-11176 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
CVE-2018-11177 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
CVE-2018-11178 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
CVE-2018-11179 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
CVE-2018-1118 (severity: MEDIUM, weakness: CWE-665)
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.
CVE-2018-11180 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
CVE-2018-11181 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
CVE-2018-11182 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
CVE-2018-11183 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
CVE-2018-11184 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).
CVE-2018-11185 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
CVE-2018-11186 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
CVE-2018-11187 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
CVE-2018-11188 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
CVE-2018-11189 (severity: HIGH, weakness: CWE-78)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
CVE-2018-11190 (severity: HIGH, weakness: CWE-269)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).
CVE-2018-11191 (severity: HIGH, weakness: CWE-732)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).
CVE-2018-11192 (severity: HIGH, weakness: CWE-732)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).
CVE-2018-11193 (severity: HIGH, weakness: CWE-732)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).
CVE-2018-11194 (severity: HIGH, weakness: CWE-732)
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).
CVE-2018-11195 (severity: MEDIUM, weakness: CWE-200)
Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious users with physical access to the web browser of a Mahara user, after they have logged in, to potentially gain access to their Mahara credentials.
CVE-2018-11196 (severity: HIGH, weakness: CWE-434)
Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers.
CVE-2018-11198 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.
CVE-2018-1120 (severity: MEDIUM, weakness: CWE-122)
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).
CVE-2018-11200 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
CVE-2018-11202 (severity: MEDIUM, weakness: CWE-476)
A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
CVE-2018-11203 (severity: MEDIUM, weakness: CWE-369)
A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
CVE-2018-11204 (severity: MEDIUM, weakness: CWE-476)
A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.
CVE-2018-11205 (severity: HIGH, weakness: CWE-125)
A out of bounds read was discovered in H5VM_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
CVE-2018-11206 (severity: HIGH, weakness: CWE-125)
An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclosure attack.
CVE-2018-11207 (severity: MEDIUM, weakness: CWE-369)
A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.