Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
com/db/modules/exploit/linux/http/zimbra_xxe_rce - http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html - https://www.exploit-db.com/exploits/46693/ - https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
CVE ID: CVE-2019-9673 State: PUBLISHED Published: 2019-06-05T15:40:45 Last Updated: 2024-08-04T21:54:45.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI. Additional Analyst Notes: - CVE Program Container: References: - https://freenetproject.org - https://github.com/mgrube/CVE-2019-9673 - https://freenetproject.org/freenet-build-1484-released.html
CVE ID: CVE-2019-9674 State: PUBLISHED Published: 2020-02-04T14:05:49 Last Updated: 2024-08-04T21:54:45.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Additional Analyst Notes: - CVE Program Container: References: - https://www.python.org/news/security/ - https://github.com/python/cpython/blob/master/Lib/zipfile.py - https://bugs.python.org/issue36462 - https://bugs.python.org/issue36260 - https://python-security.readthedocs.io/security.html#archives-and-zip-bomb - https://security.netapp.com/advisory/ntap-20200221-0003/ - http://lists.opensuse.o
security.html#archives-and-zip-bomb - https://security.netapp.com/advisory/ntap-20200221-0003/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html - https://usn.ubuntu.com/4428-1/
CVE ID: CVE-2019-9675 State: PUBLISHED Published: 2019-03-11T07:00:00 Last Updated: 2024-08-04T21:54:45.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible. Additional Analyst Notes: - CVE Program Container: References: - http://php.net/ChangeLog-7.php - https://bugs.php.net/bug.php?id=77586 - http
es: - CVE Program Container: References: - http://php.net/ChangeLog-7.php - https://bugs.php.net/bug.php?id=77586 - https://usn.ubuntu.com/3922-2/ - https://usn.ubuntu.com/3922-3/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html
CVE ID: CVE-2019-9676 State: PUBLISHED Published: 2019-06-12T14:12:03 Last Updated: 2024-08-04T21:54:45.166Z Vendors: n/a Products: IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Problem Types: Buffer overflow Description: Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing pr
art or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/617
CVE ID: CVE-2019-9677 State: PUBLISHED Published: 2019-09-18T18:46:29 Last Updated: 2024-08-04T21:54:45.468Z Vendors: Dahua Technology Products: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X Problem Types: Buffer Overflow Description: The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE Program Contain
X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/637
CVE ID: CVE-2019-9678 State: PUBLISHED Published: 2019-09-18T18:42:45 Last Updated: 2024-08-04T21:54:45.263Z Vendors: Dahua Technology Products: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X Problem Types: Denial of Service Description: Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE Program Containe
2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/637
CVE ID: CVE-2019-9679 State: PUBLISHED Published: 2019-09-18T18:32:15 Last Updated: 2024-08-04T21:54:45.238Z Vendors: Dahua Technology Products: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X Problem Types: Privilege Escalation Description: Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019. Additional Analyst Notes: - CVE Program Container: References: - https:/
ions which Build time is before August 18,2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/637
CVE ID: CVE-2019-9680 State: PUBLISHED Published: 2019-09-18T18:36:13 Last Updated: 2024-08-04T21:54:45.483Z Vendors: Dahua Technology Products: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X Problem Types: Information Leakage Description: Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious data packets. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE P
W4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18, 2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/637
CVE ID: CVE-2019-9681 State: PUBLISHED Published: 2019-09-17T16:02:18 Last Updated: 2024-08-04T21:54:45.133Z Vendors: Dahua Products: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X Problem Types: Information Leakage Description: Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019. Additional Analyst Notes: - CVE Program
IPC-HDW5X2X,IPC-HFW5X2X for versions which Build time is before August 18,2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/637
CVE ID: CVE-2019-9682 State: PUBLISHED Published: 2020-05-13T15:10:43 Last Updated: 2024-08-04T21:54:45.174Z Vendors: n/a Products: IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX7842H,NVR 5x Series,NVR 4x Series,SD6AL Series,SD5A Series,SD1A Series,PTZ1A Series,SD50/52C Series,IPC-HDBW1320E-W Problem Types: Replay Attacks Description: Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packe
ol. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method. Additional Analyst Notes: - CVE Program Container: References: - https://www.dahuasecurity.com/support/cybersecurity/details/767
CVE ID: CVE-2019-9686 State: PUBLISHED Published: 2019-03-11T16:00:00 Last Updated: 2024-08-04T21:54:45.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem,
f downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c. Additional Analyst Notes: - CVE Program Container: References: - https://git.archlinux.org/pacman.git/commit/?id=d197d8ab82cf10650487518fb968067897a12775 - https://git.archlinux.org/pacman.git/commit/?h=release/5.1.x&id=1bf767234363f7ad5933af3f7ce267c123017bde - https://git.archlinux.org/pacman.git/commit/?id=9702703633bec2c007730006de2aeec8587dfc84
CVE ID: CVE-2019-9687 State: PUBLISHED Published: 2019-03-11T16:00:00 Last Updated: 2024-08-04T21:54:45.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/podofo/code/1969 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTJ5AAM6Y4NMSELEH7N5ZG4DNO56BCYF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIC2EXSSMBT3MY2HY42IIY4BUQS2SVYB/
CVE ID: CVE-2019-9688 State: PUBLISHED Published: 2019-03-11T16:00:00 Last Updated: 2024-08-04T21:54:45.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/forgeekscn/sftnow/issues/6
CVE ID: CVE-2019-9689 State: PUBLISHED Published: 2019-12-03T19:59:21 Last Updated: 2024-08-04T21:54:45.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake message with zero certificates. Additional Analyst Notes: - CVE Program Container: References: - http://axtls.sourceforge.net - https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842 - https://seclists.org/bugtraq/2019/Nov/44 - http://packetstormsecurity.com/files/155500/axTLS-2.1.5-Denial-Of-Service.html - https://www.telekom.com/
/2019/Nov/44 - http://packetstormsecurity.com/files/155500/axTLS-2.1.5-Denial-Of-Service.html - https://www.telekom.com/resource/blob/586428/51ae062269fbcb068bd20379f87f1398/dl-191121-critical-remote-denial-of-service-vulnerability-ii--data.pdf
CVE ID: CVE-2019-9692 State: PUBLISHED Published: 2019-03-11T18:00:00 Last Updated: 2024-08-04T21:54:45.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG). Additional Analyst Notes: - CVE Program Container: References: - http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47 - https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 - https://www.exploit-db.com/exploits/46546/ - http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-Fi
ps://www.exploit-db.com/exploits/46546/ - http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html - http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce - https://www.exploit-db.com/exploits/46627/
CVE ID: CVE-2019-9693 State: PUBLISHED Published: 2019-03-11T18:00:00Z Last Updated: 2024-09-17T02:27:36.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id). Additional Analyst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 - http://vie
yst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 - http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php&rev=47
CVE ID: CVE-2019-9694 State: PUBLISHED Published: 2019-04-10T19:54:45 Last Updated: 2024-08-04T21:54:45.509Z Vendors: Symantec Products: Symantec Endpoint Encryption Problem Types: Privilege Escalation Description: Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1478.html
CVE ID: CVE-2019-9695 State: PUBLISHED Published: 2019-03-29T13:32:42 Last Updated: 2024-08-04T21:54:45.143Z Vendors: Norton Products: Norton Core Problem Types: Arbitrary Code Execution Description: Norton Core prior to v278 may be susceptible to an arbitrary code execution issue, which is a type of vulnerability that has the potential of allowing an individual to execute arbitrary commands or code on a target machine or in a target process. Note that this exploit is only possible with direct physical access to the device. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1476.html - http://www.securityfocus.com/bid/107478
CVE ID: CVE-2019-9696 State: PUBLISHED Published: 2019-04-09T20:23:27 Last Updated: 2024-08-04T21:54:45.459Z Vendors: Symantec Products: Symantec VIP Enterprise Gateway Problem Types: Cross-site Scripting Description: Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1477.html -
tional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1477.html - http://www.securityfocus.com/bid/107692
CVE ID: CVE-2019-9697 State: PUBLISHED Published: 2019-08-29T22:43:44 Last Updated: 2024-08-04T21:54:45.139Z Vendors: Symantec Corporation Products: Management Center (MC) Problem Types: Information disclosure Description: An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obtain passwords for external backup and CPL policy import servers that they might not otherwise be authorized to access. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1480.html
CVE ID: CVE-2019-9698 State: PUBLISHED Published: 2019-05-08T18:46:47 Last Updated: 2024-08-04T21:54:45.478Z Vendors: n/a Products: Symantec AV Engine Problem Types: Arbitrary File Deletion Description: Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could allow an attacker to delete files on the resident system without elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1481.html
CVE ID: CVE-2019-9699 State: PUBLISHED Published: 2019-10-24T15:32:19 Last Updated: 2024-08-04T21:54:45.361Z Vendors: Symantec Products: Symantec Messaging Gateway Problem Types: Information Disclosure Description: Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1482.html
CVE ID: CVE-2019-9700 State: PUBLISHED Published: 2019-07-16T18:37:07 Last Updated: 2024-08-04T21:54:45.471Z Vendors: Norton Products: Norton Password Manager Problem Types: Address Spoof Description: Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1483.html
CVE ID: CVE-2019-9701 State: PUBLISHED Published: 2019-06-19T15:55:27 Last Updated: 2024-08-04T21:54:45.334Z Vendors: n/a Products: Data Loss Prevention Problem Types: Cross-site Scripting Description: DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1484.html - http://packetstormsecurity.com/files/1535
ner: References: - https://support.symantec.com/us/en/article.SYMSA1484.html - http://packetstormsecurity.com/files/153512/Symantec-DLP-15.5-MP1-Cross-Site-Scripting.html
CVE ID: CVE-2019-9702 State: PUBLISHED Published: 2019-07-01T20:28:16 Last Updated: 2024-08-04T21:54:45.170Z Vendors: Symantec Products: Endpoint Encryption Problem Types: Privilege Escalation Description: Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108795 - https://support.symantec.com/us/en/article.SYMSA1485.html
CVE ID: CVE-2019-9703 State: PUBLISHED Published: 2019-07-01T20:29:28 Last Updated: 2024-08-04T21:54:45.155Z Vendors: Symantec Products: Endpoint Encryption Problem Types: Privilege Escalation Description: Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108796 - https://support.symantec.com/us/en/article.SYMSA1485.html
CVE ID: CVE-2019-9704 State: PUBLISHED Published: 2019-03-12T00:00:00 Last Updated: 2024-08-04T21:54:45.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked. Additional Analyst Notes: - CVE Program Container: References: - https://salsa.debian.org/debian/cron/commit/f2525567 - http://www.securityfocus.com/bid/107373 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/ - https://lists.debian.org/debian-lts-announce/2019/03/
ists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE ID: CVE-2019-9705 State: PUBLISHED Published: 2019-03-12T00:00:00 Last Updated: 2024-08-04T21:54:45.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107378 - https://salsa.debian.org/debian/cron/commit/26814a26 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/ - https://lists.debian.org/debian-lts-announce/
unce%40lists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE ID: CVE-2019-9706 State: PUBLISHED Published: 2019-03-12T00:00:00 Last Updated: 2024-08-04T21:54:45.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error. Additional Analyst Notes: - CVE Program Container: References: - https://salsa.debian.org/debian/cron/commit/40791b93 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167 - https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.debian.org/debian-lts-announce/2021
- https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html