Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15085 State: PUBLISHED Published: 2019-09-20T13:41:12 Last Updated: 2024-08-05T00:34:53.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form. Additional Analyst Notes: - CVE Program Container: References: - http://www.adas-sso.com/es/extra/download.php - https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas
CVE ID: CVE-2019-15086 State: PUBLISHED Published: 2019-09-20T13:41:46 Last Updated: 2024-08-05T00:34:53.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.adas-sso.com/es/extra/download.php - https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas
CVE ID: CVE-2019-15087 State: PUBLISHED Published: 2019-09-20T13:42:17 Last Updated: 2024-08-05T00:34:53.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.adas-sso.com/es/extra/download.php - https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas
CVE ID: CVE-2019-15088 State: PUBLISHED Published: 2019-09-20T13:42:40 Last Updated: 2024-08-05T00:34:53.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication. Additional Analyst Notes: - CVE Program Container: References: - http://www.adas-sso.com/es/extra/download.php - https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas
CVE ID: CVE-2019-15089 State: PUBLISHED Published: 2019-09-20T13:43:08 Last Updated: 2024-08-05T00:34:53.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator. Additional Analyst Notes: - CVE Program Container: References: - http://www.adas-sso.com/es/extra/download.php - https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas
CVE ID: CVE-2019-15090 State: PUBLISHED Published: 2019-08-15T23:47:47 Last Updated: 2024-08-05T00:34:53.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/c09581a52765a85f19fc35340127396d5e3379cc - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c09581a52765a85f19fc35340127396d5e3379cc - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.12 - https://usn.ubuntu.com/4115-1/ - https
127396d5e3379cc - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.12 - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/ - https://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://usn.ubuntu.com/4147-1/
CVE ID: CVE-2019-15091 State: PUBLISHED Published: 2019-08-16T12:10:46 Last Updated: 2024-08-05T00:34:53.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/k7FuvNvx
CVE ID: CVE-2019-15092 State: PUBLISHED Published: 2019-08-23T20:51:38 Last Updated: 2024-08-05T00:34:53.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/ - https://wpvulndb.com/vulnerabilities/9704 - http://packetstormsecurity.com/files/154203/WordPress-Import-Expo
jection/ - https://wpvulndb.com/vulnerabilities/9704 - http://packetstormsecurity.com/files/154203/WordPress-Import-Export-WordPress-Users-1.3.1-CSV-Injection.html
CVE ID: CVE-2019-15095 State: PUBLISHED Published: 2019-08-16T00:28:29 Last Updated: 2024-08-05T00:34:53.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wkeyuan/DWSurvey/issues/48
CVE ID: CVE-2019-15098 State: PUBLISHED Published: 2019-08-16T01:15:39 Last Updated: 2024-08-05T00:34:53.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-wireless/20190804002905.11292-1-benquike%40gmail.com/T/#u - https://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - http://
ty-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - http://www.openwall.com/lists/oss-security/2019/09/27/3 - http://www.openwall.com/lists/oss-security/2019/09/27/2 - http://www.openwall.com/lists/oss-security/2019/09/27/1 - https://support.f5.com/csp/article/K61214359 - https://support.f5.com/csp/article/K61214359?utm_source=f5support&amp%3Butm_medium=RSS - https://seclists.org/bugtraq/2019/Nov/11 - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://usn.ubuntu.com/4185-1/ - https://usn.ubuntu.com/4184-1/ - https://usn.ubuntu.com/4186-1/ - https://usn.ubuntu.com/418
://usn.ubuntu.com/4185-1/ - https://usn.ubuntu.com/4184-1/ - https://usn.ubuntu.com/4186-1/ - https://usn.ubuntu.com/4186-2/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
CVE ID: CVE-2019-15099 State: PUBLISHED Published: 2019-08-16T01:15:29 Last Updated: 2024-08-05T00:34:53.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpoint descriptor. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-wireless/20190804003101.11541-1-benquike%40gmail.com/T/#u - https://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://support.f5.com/csp/article/K76295179 - https://support.f5.com/csp/article/K7
ty-announce/2019-09/msg00066.html - https://support.f5.com/csp/article/K76295179 - https://support.f5.com/csp/article/K76295179?utm_source=f5support&amp%3Butm_medium=RSS - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-15102 State: PUBLISHED Published: 2019-09-06T16:15:02 Last Updated: 2024-08-05T00:34:53.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intended for remote access to scripts. This web interface lacks server-side validation, which allows an attacker to create/modify/delete a script remotely without any password. Chaining both of these issues results in remote code executi
reate/modify/delete a script remotely without any password. Chaining both of these issues results in remote code execution on the Sahi Pro server. Additional Analyst Notes: - CVE Program Container: References: - https://barriersec.com/2019/08/cve-2019-15102-sahi-pro/
CVE ID: CVE-2019-15104 State: PUBLISHED Published: 2019-08-16T02:44:45 Last Updated: 2024-08-05T00:34:53.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47227 - http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privile
- https://www.exploit-db.com/exploits/47227 - http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Privilege-Escalation-Remote-Command-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15104.html
CVE ID: CVE-2019-15105 State: PUBLISHED Published: 2019-08-16T02:44:35 Last Updated: 2024-08-05T00:34:53.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47228 - http://pentest.com.tr/exploits/DEFCON-ManageEngine-APM-v14-Privil
erences: - https://www.exploit-db.com/exploits/47228 - http://pentest.com.tr/exploits/DEFCON-ManageEngine-APM-v14-Privilege-Escalation-Remote-Command-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15105.html
CVE ID: CVE-2019-15106 State: PUBLISHED Published: 2019-08-16T02:44:19 Last Updated: 2024-08-05T00:34:53.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47229 - http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Unauthenticated-Remote-Command-Execution.html - https://www.manageengine.co
exploits/DEFCON-ManageEngine-OpManager-v12-4-Unauthenticated-Remote-Command-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15106.html - https://www.manageengine.com/network-monitoring/security-updates/cve-2019-15106.html
CVE ID: CVE-2019-15107 State: PUBLISHED Published: 2019-08-16T02:44:04.000Z Last Updated: 2025-10-21T23:45:32.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.webmin.com/security.html - https://www.exploit-db.com/exploits/47230 - http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html - http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html - http://packetstormsecurity.com/files/15414
://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html - http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html - http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html - http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html - https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection
CVE ID: CVE-2019-15108 State: PUBLISHED Published: 2019-08-16T03:07:56 Last Updated: 2024-08-05T00:34:53.376Z Severity: LOW (CVSS 3.5 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0597
CVE ID: CVE-2019-15109 State: PUBLISHED Published: 2019-08-21T11:50:47 Last Updated: 2024-08-05T00:34:53.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/the-events-calendar/#developers - https://wpvulndb.com/vulnerabilities/9554
CVE ID: CVE-2019-15110 State: PUBLISHED Published: 2019-08-21T12:01:02 Last Updated: 2024-08-05T00:34:53.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-front-end-profile/#developers
CVE ID: CVE-2019-15111 State: PUBLISHED Published: 2019-08-21T12:02:18 Last Updated: 2024-08-05T00:34:53.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-front-end-profile/#developers
CVE ID: CVE-2019-15112 State: PUBLISHED Published: 2019-08-21T12:37:36 Last Updated: 2024-08-05T00:34:53.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wp-slimstat plugin before 4.8.1 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-slimstat/#developers - https://wpvulndb.com/vulnerabilities/9285
CVE ID: CVE-2019-15113 State: PUBLISHED Published: 2019-08-16T20:20:26 Last Updated: 2024-08-05T00:34:53.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/companion-sitemap-generator/#developers
CVE ID: CVE-2019-15114 State: PUBLISHED Published: 2019-08-16T20:18:44 Last Updated: 2024-08-05T00:34:53.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/formcraft-form-builder/#developers
CVE ID: CVE-2019-15115 State: PUBLISHED Published: 2019-08-16T20:13:36 Last Updated: 2024-08-05T00:34:53.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/peters-login-redirect/#developers
CVE ID: CVE-2019-15116 State: PUBLISHED Published: 2019-08-16T20:12:04 Last Updated: 2024-08-05T00:34:53.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9334 - https://wordpress.org/plugins/easy-digital-downloads/#developers
CVE ID: CVE-2019-15117 State: PUBLISHED Published: 2019-08-16T13:45:02 Last Updated: 2024-08-05T00:34:53.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=daac07156b330b18eb5071aec4b3ddca1c377f2c - https://lore.kernel.org/lkml/20190814023625.21683-1-benquike%40gmail.com/ - https://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg
ps://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html - https://seclists.org/bugtraq/2019/Sep/41 - https://www.debian.org/security/2019/dsa-4531 - https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html - https://usn.ubuntu.com/4147-1/ - https://support.f5.com/csp/article/K16449953?utm_source=f5support&amp%3Butm_medium=RSS - https://usn.ubuntu.com/4162-1/ - https://usn.ubuntu.com/4163-1/ - https://usn.ubuntu.com/4163-2/ - https://usn.ubuntu.com/4162-2/ - https:/
com/4162-1/ - https://usn.ubuntu.com/4163-1/ - https://usn.ubuntu.com/4163-2/ - https://usn.ubuntu.com/4162-2/ - https://seclists.org/bugtraq/2019/Nov/11 - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE ID: CVE-2019-15118 State: PUBLISHED Published: 2019-08-16T13:44:50 Last Updated: 2024-08-05T00:34:53.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=19bce474c45be69a284ecee660aa12d8f1e88f18 - https://lore.kernel.org/lkml/20190815043554.16623-1-benquike%40gmail.com/ - https://security.netapp.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http:/
p.com/advisory/ntap-20190905-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html - https://seclists.org/bugtraq/2019/Sep/41 - https://www.debian.org/security/2019/dsa-4531 - https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html - https://usn.ubuntu.com/4147-1/ - https://usn.ubuntu.com/4162-1/ - https://usn.ubuntu.com/4163-1/ - https://usn.ubuntu.com/4163-2/ - https://usn.ubuntu.com/4162-2/ - https://seclists.org/bugtraq/2019/Nov/11 - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-
2/ - https://seclists.org/bugtraq/2019/Nov/11 - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE ID: CVE-2019-15119 State: PUBLISHED Published: 2019-08-16T14:02:31 Last Updated: 2024-08-05T00:34:53.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cnlh/nps/issues/176 - https://github.com/cnlh/nps/commit/7178b3380720e910d283036a8d39879a94105515
CVE ID: CVE-2019-15120 State: PUBLISHED Published: 2019-08-16T14:16:26 Last Updated: 2024-08-05T00:34:53.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode. Additional Analyst Notes: - CVE Program Container: References: - https://www.kunena.org/blog/207-kunena-5-1-14-released - https://vel.joomla.org/resolved/2260-kunena-5-0-x-5-1-14-xss-cross-site-scripting - https://github.com/h3llraiser/CVE-2019-15120
CVE ID: CVE-2019-15123 State: PUBLISHED Published: 2020-06-12T20:42:46 Last Updated: 2024-08-05T00:34:53.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site. Additional Analyst Notes: - CVE Program Container: References: - http://www.vikisolutions.com/products/Vera.html - https://www.gosecure.net/blog/2020/06/11/vera-vulnerable-to-authenticated-remote-code-execution-cve-2019-15123/
CVE ID: CVE-2019-15124 State: PUBLISHED Published: 2020-03-19T18:09:05 Last Updated: 2024-08-05T00:34:53.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T230576
CVE ID: CVE-2019-15126 State: PUBLISHED Published: 2020-02-05T16:17:37 Last Updated: 2024-08-05T00:34:53.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT210721 - https://s
9503. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT210721 - https://support.apple.com/kb/HT210722 - https://support.apple.com/kb/HT210788 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0001 - http://www.huawei.com/en/psirt/security-notices/huawei-sn-20200228-01-kr00k-en - https://www.mist.com/documentation/mist-security-advisory-kr00k-attack-faq/ - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt - https://www.synology.com/security/advisory/Synology_SA_20_03 - http://packetstormsecurity.com/files/15680
2020-003.txt - https://www.synology.com/security/advisory/Synology_SA_20_03 - http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-wifi-en - https://cert-portal.siemens.com/productcert/pdf/ssa-712518.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-224-05
CVE ID: CVE-2019-15127 State: PUBLISHED Published: 2019-08-21T18:14:38 Last Updated: 2024-08-05T00:34:53.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. Additional Analyst Notes: - CVE Program Container: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/