Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12761 State: PUBLISHED Published: 2019-06-06T18:55:27 Last Updated: 2024-08-04T23:32:54.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba - https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562 - https://lists.debian.org
.com/dhondta/b45cd41f4186110a354dc7272916feba - https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562 - https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html - https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html
CVE ID: CVE-2019-12762 State: PUBLISHED Published: 2019-06-06T19:45:22 Last Updated: 2024-08-04T23:32:54.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated by a transmitter and antenna hidden just beneath the surface of a coffee-shop table, aka Ghost Touch. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40juliodellaflora/ghost-touch-on-xiaomi-mi5s-plus-707998308607 - https://hackercombat.com/nfc-vulnerability-may-promote-ghost-screen-taps/
CVE ID: CVE-2019-12763 State: PUBLISHED Published: 2019-06-07T11:32:53 Last Updated: 2024-08-04T23:32:54.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is readable by any application. Additional Analyst Notes: - CVE Program Container: References: - https://hansesecure.de/2019/05/vulnerability-security-camera-cz-storage/
CVE ID: CVE-2019-12764 State: PUBLISHED Published: 2019-06-11T18:33:22 Last Updated: 2024-08-04T23:32:55.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/785-20190603-core-acl-hardening-of-com-joomlaupdate - http://www.securityfocus.com/bid/108729
CVE ID: CVE-2019-12765 State: PUBLISHED Published: 2019-06-11T18:35:33 Last Updated: 2024-08-04T23:32:55.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/783-20190601-core-csv-injection-in-com-actionlogs - http://www.securityfocus.com/bid/108736
CVE ID: CVE-2019-12766 State: PUBLISHED Published: 2019-06-11T18:36:42 Last Updated: 2024-08-04T23:32:55.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/784-20190602-core-xss-in-subform-field - http://www.securityfocus.com/bid/108735
CVE ID: CVE-2019-12767 State: PUBLISHED Published: 2020-03-21T00:16:30 Last Updated: 2024-08-04T23:32:54.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DAP-1650/REVA/DAP-1650_REVA_RELEASE_NOTES_v1.04B02_J65H.pdf
CVE ID: CVE-2019-12768 State: PUBLISHED Published: 2020-12-30T19:26:30 Last Updated: 2024-08-04T23:32:54.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing. Additional Analyst Notes: - CVE Program Container: References: - ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DAP-1650/REVA/DAP-1650_REVA_RELEASE_NOTES_v1.04B02_J65H.pdf
CVE ID: CVE-2019-12769 State: PUBLISHED Published: 2020-03-18T17:38:10 Last Updated: 2024-08-04T23:32:55.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality via ?Command=Upload with the Dir and File parameters. Additional Analyst Notes: - CVE Program Container: References: - https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-1-6-HotFix-2 - https://medium.com/%40clod81/cve-2019-12769-solarwinds-serv-u-managed-file-transfer-mft-web-client-15-1-6-a2dab98d668d
CVE ID: CVE-2019-12771 State: PUBLISHED Published: 2019-06-07T13:05:23 Last Updated: 2024-08-04T23:32:55.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/VolControl.cgi OK= substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Thinstation/thinstation/issues/427
CVE ID: CVE-2019-12773 State: PUBLISHED Published: 2020-07-14T19:27:54 Last Updated: 2024-08-04T23:32:55.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Verint Impact 360 15.1. At wfo/help/help_popup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFrame. Attackers may use this in conjunction with social engineering to embed malicious scripts or phishing pages on a site where this product is installed, given the attacker can convince a victim to visit a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Jul/15 - http://packetstormsecurity.com/files
Program Container: References: - https://seclists.org/fulldisclosure/2020/Jul/15 - http://packetstormsecurity.com/files/158411/Verint-Impact-360-15.1-Script-Insertion-HTML-Injection.html
CVE ID: CVE-2019-12774 State: PUBLISHED Published: 2019-06-07T15:06:04 Last Updated: 2024-08-04T23:32:54.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/?p=3476
CVE ID: CVE-2019-12775 State: PUBLISHED Published: 2019-06-07T15:06:21 Last Updated: 2024-08-04T23:32:54.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible
sword authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.) Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/?p=3476
CVE ID: CVE-2019-12776 State: PUBLISHED Published: 2019-06-07T15:06:30 Last Updated: 2024-08-04T23:32:54.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocate_revB scripts copies the hardcoded key to the root user's authorized_keys file, enabling anyone with the associated private key to gain remote root access to all affected products. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/?p
s to all affected products. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/?p=3476
CVE ID: CVE-2019-12777 State: PUBLISHED Published: 2019-06-07T15:06:42 Last Updated: 2024-08-04T23:32:55.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing fil
y allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories. Additional Analyst Notes: - CVE Program Container: References: - https://www.mogozobo.com/?p=3476
CVE ID: CVE-2019-12779 State: PUBLISHED Published: 2019-06-07T19:44:25 Last Updated: 2024-08-04T23:32:54.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClusterLabs/libqb/issues/338 - https://bugzilla.redhat.com/show_bug.cgi?id=1695948 - https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5 - https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4 - http://www.securityfocus.com/bid/108691 - http://lists.opensuse.org/opensus
.com/ClusterLabs/libqb/releases/tag/v1.0.4 - http://www.securityfocus.com/bid/108691 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00031.html - https://access.redhat.com/errata/RHSA-2019:3610 - https://security.gentoo.org/glsa/202107-03
CVE ID: CVE-2019-12780 State: PUBLISHED Published: 2019-06-10T15:46:05 Last Updated: 2024-08-04T23:32:55.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46436
CVE ID: CVE-2019-12781 State: PUBLISHED Published: 2019-07-01T13:56:37 Last Updated: 2024-08-04T23:32:54.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21topic/django-anno
nces: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/forum/#%21topic/django-announce/Is4kLY9ZcZQ - https://www.djangoproject.com/weblog/2019/jul/01/security-releases/ - http://www.openwall.com/lists/oss-security/2019/07/01/3 - https://usn.ubuntu.com/4043-1/ - http://www.securityfocus.com/bid/109018 - https://security.netapp.com/advisory/ntap-20190705-0002/ - https://www.debian.org/security/2019/dsa-4476 - https://seclists.org/bugtraq/2019/Jul/10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
/message/5VXXWIOQGXOB7JCGJ3CVUW673LDHKEYL/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
CVE ID: CVE-2019-12782 State: PUBLISHED Published: 2019-07-09T15:20:44 Last Updated: 2024-08-04T23:32:55.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at least one pinboard to corrupt pinboards of another user in the application by spoofing GUIDs in pinboard update requests, effectively deleting them. Additional Analyst Notes: - CVE Program Container: References: - https://www.vsecurity.com/resources/advisories.html - https://docs.thoughtspot.com/5.1/release/notes.html - https://www.vsecurity.com/download/advisories/201
dvisories.html - https://docs.thoughtspot.com/5.1/release/notes.html - https://www.vsecurity.com/download/advisories/201912782-1.txt
CVE ID: CVE-2019-12783 State: PUBLISHED Published: 2020-07-14T19:22:12 Last Updated: 2024-08-04T23:32:54.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successful login. In conjunction with CVE-2019-12784, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and potentially compromise valid credentials without ever sending any traffic from their own machine to the target site. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/ful
wn machine to the target site. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Jul/16 - http://packetstormsecurity.com/files/158412/Verint-Impact-360-15.1-Open-Redirect.html
CVE ID: CVE-2019-12784 State: PUBLISHED Published: 2020-07-14T19:25:24 Last Updated: 2024-08-04T23:32:54.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and potentially compromise valid credentials without ever sending any traffic from their own machine to the target site. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Jul/17 - http://
ditional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Jul/17 - http://packetstormsecurity.com/files/158413/Verint-Impact-360-15.1-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-12786 State: PUBLISHED Published: 2019-06-10T17:49:30 Last Updated: 2024-08-04T23:32:55.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-protected.pdf
CVE ID: CVE-2019-12787 State: PUBLISHED Published: 2019-06-10T17:49:38 Last Updated: 2024-08-04T23:32:55.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/dlink/dir818-2-protected.pdf
CVE ID: CVE-2019-12788 State: PUBLISHED Published: 2019-06-10T18:14:50 Last Updated: 2024-08-04T23:32:55.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a buffer overflow via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://risataim.blogspot.com/2019/06/exploit-local-para-proshow.html - https://github.com/risataimpt/Archivos_del_Blog/tree/master/Proshow - http://packetstormsecurity.com/files/153249/ProShow-9.0.3797-Privilege-Escalation.html
CVE ID: CVE-2019-12789 State: PUBLISHED Published: 2019-06-17T16:19:57 Last Updated: 2024-08-04T23:32:55.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system board, an attacker can use a special key sequence (Ctrl-\) to obtain a shell with root privileges. After gaining root access, the attacker can mount the filesystem read-write and make permanent modifications to the device including bricking of the device, disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on t
disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.actiontec.com/blog/ - http://seclists.org/fulldisclosure/2019/Jun/10
CVE ID: CVE-2019-12790 State: PUBLISHED Published: 2019-06-10T18:41:59 Last Updated: 2024-08-04T23:32:54.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/14211 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SX4TLTE75VYUGSPYEKMYFPUZMRD
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SX4TLTE75VYUGSPYEKMYFPUZMRDIR7O2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IEXZWAMVKGZKHALV4IVWQS2ORJKRH57U/
CVE ID: CVE-2019-12791 State: PUBLISHED Published: 2019-08-15T20:34:18 Last Updated: 2024-08-04T23:32:55.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form. Additional Analyst Notes: - CVE Program Container: References: - https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-password-reset-form/ - https://github.com/serghey-rodin/vesta/issues/1921
CVE ID: CVE-2019-12792 State: PUBLISHED Published: 2019-08-15T20:39:26 Last Updated: 2024-08-04T23:32:55.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/serghey-rodin/vesta/issues/1921 - https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-upload-handler/
CVE ID: CVE-2019-12794 State: PUBLISHED Published: 2019-06-11T16:38:19 Last Updated: 2024-08-04T23:32:55.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). This, however, could be abused in a situation where the host organization of an instance creates organization admins. An organization admin could set a password manually for the site admin or simply use the API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates
he API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates lower-privilege organization admins instead of the usual site admins. Also, only organization admins of the same organization as the site admin could abuse this. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/36b43f1306873cff87b7aa30cdc1a30b38c9c16a
CVE ID: CVE-2019-12795 State: PUBLISHED Published: 2019-06-11T21:07:32 Last Updated: 2024-08-04T23:32:54.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.) Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gv
fore its owner does.) Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a - https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f - https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe - http://www.securityfocus.com/bid/108741 - https://lists.debian.org/debian-lts-announce/2019/06/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - https://lists.fedoraproject.org/archives/list/package-ann
ounce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/ - https://access.redhat.com/errata/RHSA-2019:3553
CVE ID: CVE-2019-12797 State: PUBLISHED Published: 2019-07-31T18:21:40 Last Updated: 2024-08-04T23:32:54.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle. Additional Analyst Notes: - CVE Program Container: References: - https://www.kth.se/polopoly_fs/1.914060.1561621279%21/Ludvig%20and%20Daniel_final_dongles.pdf - https://www.kth.se/polopoly_fs/1.917488.1564430206%21/elm327.pdf