Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12494 State: PUBLISHED Published: 2019-06-05T18:44:33 Last Updated: 2024-08-04T23:24:38.439Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gardener/vpn/issues/40 - https://github.com/gardener/gardener/pull/874 - https://groups.google.com/forum/#%
//github.com/gardener/vpn/issues/40 - https://github.com/gardener/gardener/pull/874 - https://groups.google.com/forum/#%21topic/gardener/pH6dNIEhv-A
CVE ID: CVE-2019-12495 State: PUBLISHED Published: 2019-05-31T10:45:28 Last Updated: 2024-08-04T23:24:38.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsym_addr function in x86_64-gen.c. This occurs because tccasm.c mishandles section switches. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/tinycc-devel/2019-05/msg00044.html - https://repo.or.cz/tinycc.git/commit/d04ce7772c2bc2781ab2502e0b1f1964488814b5 - http://www.securityfocus.com/bid/108541
CVE ID: CVE-2019-12496 State: PUBLISHED Published: 2019-05-31T10:59:23 Last Updated: 2024-08-04T23:24:38.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hybridgroup/gobot/releases/tag/v1.13.0 - https://github.com/hybridgroup/gobot/compare/ed53198...7f973df
CVE ID: CVE-2019-12497 State: PUBLISHED Published: 2019-06-17T00:00:00 Last Updated: 2024-08-04T23:24:38.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents (e.g., Name and mail address) can be disclosed in external notes. Additional Analyst Notes: - CVE Program Container: References: - https://community.otrs.com/category/security-advisories-en/ - https://lists.debian.org/debian-lts-announce/2019/06/msg00004.html - http://lists.opensuse.org/opensuse
advisories-en/ - https://lists.debian.org/debian-lts-announce/2019/06/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2019-12498 State: PUBLISHED Published: 2020-03-20T18:37:23 Last Updated: 2024-08-04T23:24:38.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-live-chat-support/#developers - https://plugins.trac.wordpress.org/changeset/2098577/wp-live-chat-support/trunk - https://plugins.trac.wordpress.org/log/wp-live-chat-support/
CVE ID: CVE-2019-12499 State: PUBLISHED Published: 2019-05-31T11:35:12 Last Updated: 2024-08-04T23:24:38.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736. Additional Analyst Notes: - CVE Prog
LL), or by using the --shutdown control command). This is similar to CVE-2019-5736. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netblue30/firejail/issues/2401 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDY7B73YDRBURA25APSHD5PFEO4TNSFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGVULJ6IKVDO6UAVIQRHQVSKOUD6QDWM/
CVE ID: CVE-2019-12500 State: PUBLISHED Published: 2019-05-31T11:55:23 Last Updated: 2024-08-04T23:24:38.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zimperium.com/dont-give-me-a-brake-xiaomi-scooter-hack-enables-dangerous-accelerations-and-stops-for-unsuspecting-riders/
CVE ID: CVE-2019-12502 State: PUBLISHED Published: 2019-05-31T12:04:55 Last Updated: 2024-08-04T23:24:38.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/llandeilocymro/55a61e3730cdef56ab5806a677ba0891
CVE ID: CVE-2019-12503 State: PUBLISHED Published: 2019-12-02T16:57:30 Last Updated: 2024-08-04T23:24:38.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokum
ver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-027.txt - http://seclists.org/fulldisclosure/2019/Nov/30 - http://packetstormsecurity.com/files/155503/Inateck-BCST-60-Barcode-Scanner-Keystroke-Injection.html
CVE ID: CVE-2019-12504 State: PUBLISHED Published: 2019-06-07T20:23:34 Last Updated: 2024-08-04T23:24:38.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Pu
this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-008.txt - https://seclists.org/bugtraq/2019/Jun/3 - http://packetstormsecurity.com/files/153185/Inateck-2.4-GHz-Wearable-Wireless-Presenter-WP2002-Keystroke-Injection.html - http://seclists.org/fulldisclosure/2019/Jun/14
CVE ID: CVE-2019-12505 State: PUBLISHED Published: 2019-06-07T20:04:48 Last Updated: 2024-08-04T23:24:38.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokume
er of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-007.txt - https://seclists.org/bugtraq/2019/Jun/2 - http://packetstormsecurity.com/files/153184/Inateck-2.4-GHz-Wireless-Presenter-WP1001-Keystroke-Injection.html - http://seclists.org/fulldisclosure/2019/Jun/4
CVE ID: CVE-2019-12506 State: PUBLISHED Published: 2019-06-07T20:26:42 Last Updated: 2024-08-04T23:24:37.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://w
ted with an affected receiver of this device. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-015.txt - https://seclists.org/bugtraq/2019/Jun/4 - http://packetstormsecurity.com/files/153186/Logitech-R700-Laser-Presentation-Remote-Keystroke-Injection.html - http://seclists.org/fulldisclosure/2019/Jun/15
CVE ID: CVE-2019-12507 State: PUBLISHED Published: 2019-05-31T13:44:24 Last Updated: 2024-08-04T23:24:38.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Grandt/PHPRelativePath/pull/5/commits/13273e019d737f8eb4d7b1fe1eb665185dddfb5a - https://github.com/Grandt/PHPRelativePath/pull/5
CVE ID: CVE-2019-12510 State: PUBLISHED Published: 2020-02-24T18:16:22 Last Updated: 2024-08-04T23:24:38.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the device's LAN IP address (192.168.1.1) in every request. As a result, an attacker may modify almost all of the device's settings and view various configuration settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2019-12511 State: PUBLISHED Published: 2020-02-24T18:16:26 Last Updated: 2024-08-04T23:24:39.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled, and a valid authentication JWT, additional vulnerabilities (CVE-2019-12510) allow an attacker to interact with the entire SOAP API without authentication. Additionally, DNS rebinding techniques may be used to exploit this vulnerabil
he entire SOAP API without authentication. Additionally, DNS rebinding techniques may be used to exploit this vulnerability remotely. Exploiting this vulnerability is somewhat involved. The following limitations apply to the payload and must be overcome for successful exploitation: - No more than 17 characters may be used. - At least one colon must be included to prevent mangling. - A single-quote and meta-character must be used to break out of the existing command. - Parent command remnants after the injection point must be dealt with. - The payload must be in all-caps. Despite these limitations, it is still possible to gain access to an interactive root shell via this vulnerability. Since
spite these limitations, it is still possible to gain access to an interactive root shell via this vulnerability. Since the web server assigns certain HTTP headers to environment variables with all-caps names, it is possible to insert a payload into one such header and reference the subsequent environment variable in the injection point. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2019-12512 State: PUBLISHED Published: 2020-02-24T18:16:28 Last Updated: 2024-08-04T23:24:39.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanced settings->Administration->Logs, and may trigger when the page is viewed. Although this value is inserted into a textarea tag, the attack simply needs to supply a closing textarea tag. Additional Analyst Notes: - CVE Program Contain
textarea tag, the attack simply needs to supply a closing textarea tag. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2019-12513 State: PUBLISHED Published: 2020-02-24T18:16:30 Last Updated: 2024-08-04T23:24:38.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious hostname. This log entry may then be viewed at Advanced settings->Administration->Logs to trigger the exploit. Although this value is inserted into a textarea tag, converted to all-caps, and limited in length, attacks are still possible.
gh this value is inserted into a textarea tag, converted to all-caps, and limited in length, attacks are still possible. Additional Analyst Notes: - CVE Program Container: References: - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2019-12515 State: PUBLISHED Published: 2019-06-01T23:39:32 Last Updated: 2024-08-04T23:24:38.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure or a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PanguL4b/pocs/tree/master/xpdf/out-of-bounds-read-in-FlateStream__getChar - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
ut-of-bounds-read-in-FlateStream__getChar - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWEWFUVITPA3Y6F4A5SJSROKYT7PRH7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNIJWRYTCLGV35WGIHYTMMOPEEOOTIPT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJJD7X3ES7ZHJUY2R3DAVCJPV23R64VK/
CVE ID: CVE-2019-12516 State: PUBLISHED Published: 2019-09-13T12:19:23 Last Updated: 2024-08-04T23:24:38.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/slickquiz/#developers - http://packetstormsecurity.com/files/154440/WordPress-SlickQuiz-1.3.7.1-SQL-Injection.html
CVE ID: CVE-2019-12517 State: PUBLISHED Published: 2019-09-13T12:20:44 Last Updated: 2024-08-04T23:24:38.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/a
this data, a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/slickquiz/#developers - http://packetstormsecurity.com/files/154439/WordPress-SlickQuiz-1.3.7.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-12518 State: PUBLISHED Published: 2019-12-02T16:49:52 Last Updated: 2024-08-04T23:24:38.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html - http://packetstormsecurity.com/files/156335/Anviz-CrossChex-Buffer-Overflow.html
CVE ID: CVE-2019-12519 State: PUBLISHED Published: 2020-04-15T19:20:41 Last Updated: 2024-08-04T23:24:37.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jeriko.one/security/-/b
't overflow. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12519.txt - http://www.openwall.com/lists/oss-security/2020/04/23/1 - https://www.debian.org/security/2020/dsa-4682 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html - https://security.gentoo.org/glsa/202005-05 - https://usn.ubuntu.com/4356-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://security.netapp.com/advisory/ntap-20210205-0006/
CVE ID: CVE-2019-12520 State: PUBLISHED Published: 2020-04-15T19:14:25 Last Updated: 2024-08-04T23:24:38.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query
o provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Versions/v4/ - http://www.squid-cache.org/Versions/v4/changesets/ - https://github.com/squid-cache/squid/
quid-cache.org/Versions/v4/ - http://www.squid-cache.org/Versions/v4/changesets/ - https://github.com/squid-cache/squid/commits/v4 - https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12520.txt - https://www.debian.org/security/2020/dsa-4682 - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://usn.ubuntu.com/4446-1/ - https://security.netapp.com/advisory/ntap-20210205-0006/
CVE ID: CVE-2019-12521 State: PUBLISHED Published: 2020-04-15T18:47:43 Last Updated: 2024-08-04T23:24:38.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing. Additional Analyst No
ucture so it can't affect adjacent memory blocks, and thus just leads to a crash while processing. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12521.txt - http://www.openwall.com/lists/oss-security/2020/04/23/1 - https://www.debian.org/security/2020/dsa-4682 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html - https://security.gentoo.org/glsa/202005-05 - https://usn.ubuntu.com/4356-1/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html - https://security.netapp.com/advisory/ntap-20210205-0006/
CVE ID: CVE-2019-12522 State: PUBLISHED Published: 2020-04-15T19:00:01 Last Updated: 2024-08-04T23:24:38.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12522.txt - https://security.netapp.com/advisory/
tps://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12522.txt - https://security.netapp.com/advisory/ntap-20210205-0006/
CVE ID: CVE-2019-12523 State: PUBLISHED Published: 2019-11-26T16:39:59 Last Updated: 2024-08-04T23:24:39.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - http://www.squ