Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5406 State: PUBLISHED Published: 2019-08-09T17:38:16 Last Updated: 2024-08-04T19:54:53.379Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE 3PAR StoreServ Management and Core Software Media Problem Types: remote session reuse Description: A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE ID: CVE-2019-5407 State: PUBLISHED Published: 2019-08-09T17:39:35 Last Updated: 2024-08-04T19:54:53.234Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE 3PAR StoreServ Management and Core Software Media Problem Types: remote information disclosure Description: A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03946en_us
CVE ID: CVE-2019-5408 State: PUBLISHED Published: 2019-08-09T17:49:26 Last Updated: 2024-08-04T19:54:53.465Z Vendors: Hewlett Packard Enterprise (HPE) Products: HP XP7 CVAE Problem Types: remote access restriction bypass; remote access restriction bypass Description: Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machi
earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us
CVE ID: CVE-2019-5409 State: REJECTED Published: 2020-06-01T14:55:52 Last Updated: 2020-06-01T14:55:52 Description: No description available.
CVE ID: CVE-2019-5410 State: REJECTED Published: 2020-06-01T14:55:52 Last Updated: 2020-06-01T14:55:52 Description: No description available.
CVE ID: CVE-2019-5411 State: REJECTED Published: 2020-06-01T14:55:52 Last Updated: 2020-06-01T14:55:52 Description: No description available.
CVE ID: CVE-2019-5412 State: REJECTED Published: 2020-06-01T14:55:52 Last Updated: 2020-06-01T14:55:52 Description: No description available.
CVE ID: CVE-2019-5413 State: PUBLISHED Published: 2019-03-17T19:36:35 Last Updated: 2024-08-04T19:54:53.476Z Vendors: n/a Products: morgan Problem Types: CWE-94 Description: An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/390881 - https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E - https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
CVE ID: CVE-2019-5414 State: PUBLISHED Published: 2019-03-17T19:42:05 Last Updated: 2024-08-04T19:54:53.466Z Vendors: n/a Products: kill-port Problem Types: CWE-77 Description: If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/389561
CVE ID: CVE-2019-5415 State: PUBLISHED Published: 2019-03-17T19:28:37 Last Updated: 2024-08-04T19:54:53.375Z Vendors: n/a Products: serve Problem Types: CWE-548 Description: A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/330724
CVE ID: CVE-2019-5416 State: PUBLISHED Published: 2019-03-17T19:34:59 Last Updated: 2024-08-04T19:54:53.459Z Vendors: n/a Products: localhost-now Problem Types: CWE-22 Description: A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/334837
CVE ID: CVE-2019-5417 State: PUBLISHED Published: 2019-03-17T19:24:24 Last Updated: 2024-08-04T19:54:53.458Z Vendors: n/a Products: serve Problem Types: Directory Traversal (Local File Inclusion) Description: A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/358645
CVE ID: CVE-2019-5418 State: PUBLISHED Published: 2019-03-27T13:38:58.000Z Last Updated: 2025-10-21T23:45:41.038Z Vendors: Rails Products: https://github.com/rails/rails Problem Types: CWE-22 Description: There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/46585/ - http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html - http://www.openwall.com/li
p://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html - http://www.openwall.com/lists/oss-security/2019/03/22/1 - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q - https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html - https://access.redhat.com/errata/RHSA-2019:0796 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/ - https://access.redhat.com/errata/RHSA-2019:1149 - https:/
.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/ - https://access.redhat.com/errata/RHSA-2019:1149 - https://access.redhat.com/errata/RHSA-2019:1147 - https://access.redhat.com/errata/RHSA-2019:1289
CVE ID: CVE-2019-5419 State: PUBLISHED Published: 2019-03-27T13:43:19 Last Updated: 2024-08-04T19:54:53.468Z Vendors: Rails Products: https://github.com/rails/rails Problem Types: CWE-400 Description: There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/03/22/1 - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - https://groups.google.com/forum/#%21topic/rubyonrails-securit
.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - https://groups.google.com/forum/#%21topic/rubyonrails-security/GN7w9fFAQeI - https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html - https://access.redhat.com/errata/RHSA-2019:0796 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/ - https://access.redhat.com/errata/RHSA-2019:1149 - https://access.redhat.com/errata/RHSA-2019:1147 - https://access.redhat.com/errata/RHSA-2019:1289 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html - http://l
redhat.com/errata/RHSA-2019:1289 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
CVE ID: CVE-2019-5420 State: PUBLISHED Published: 2019-03-27T13:48:13 Last Updated: 2024-08-04T19:54:53.584Z Vendors: Rails Products: https://github.com/rails/rails Problem Types: CWE-77 Description: A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit. Additional Analyst Notes: - CVE Program Container: References: - https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - https://groups.google.com/forum/#%21topic/rubyonrails
yonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/ - https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw - http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html - https://www.exploit-db.com/exploits/46785/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
CVE ID: CVE-2019-5421 State: PUBLISHED Published: 2019-04-03T14:21:37 Last Updated: 2024-08-04T19:54:53.557Z Vendors: Plataformatec Products: Devise ruby gem Problem Types: CWE-367 Description: Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.
ar to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/plataformatec/devise/issues/4981 - https://github.com/plataformatec/devise/pull/4996
CVE ID: CVE-2019-5422 State: PUBLISHED Published: 2019-04-03T14:21:40 Last Updated: 2024-08-04T19:54:53.644Z Vendors: Npm, Inc. Products: buttle Problem Types: CWE-79 Description: XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/331110
CVE ID: CVE-2019-5423 State: PUBLISHED Published: 2019-04-03T14:21:42 Last Updated: 2024-08-04T19:54:53.489Z Vendors: Npm, Inc. Products: http-live-simulator Problem Types: CWE-22 Description: Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/384939
CVE ID: CVE-2019-5424 State: PUBLISHED Published: 2019-04-10T17:31:24 Last Updated: 2024-08-04T19:54:53.577Z Vendors: Ubiquiti Networks Products: EdgeMAX Problem Types: CWE-77 Description: In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute shell commands under the root user. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/508256 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137
CVE ID: CVE-2019-5425 State: PUBLISHED Published: 2019-04-10T17:50:53 Last Updated: 2024-08-04T19:54:53.473Z Vendors: Ubiquiti Networks Products: EdgeMAX Problem Types: Privilege Escalation (CAPEC-233) Description: In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/511025 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137
CVE ID: CVE-2019-5426 State: PUBLISHED Published: 2019-04-10T17:53:05 Last Updated: 2024-08-04T19:54:53.513Z Vendors: Ubiquiti Networks Products: EdgeMAX Problem Types: CWE-287 Description: In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/512958 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-
erences: - https://hackerone.com/reports/512958 - https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-EdgeSwitch-X-software-release-v1-1-1/ba-p/2731137
CVE ID: CVE-2019-5427 State: PUBLISHED Published: 2019-04-22T20:52:56 Last Updated: 2024-08-04T19:54:53.546Z Vendors: n/a Products: c3p0 Problem Types: CWE-776 Description: c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFIVX6HOVNLAM7W3SUAMHYRNLCVQSAWR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQ47OFV57Y2DAHMGA5H3JOL4WHRWRFN4/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://hackerone.com/reports/509315 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2019-5428 State: REJECTED Published: 2019-04-22T20:41:25 Last Updated: 2019-04-25T15:10:30 Description: No description available.
CVE ID: CVE-2019-5429 State: PUBLISHED Published: 2019-04-29T14:13:02 Last Updated: 2024-08-04T19:54:53.465Z Vendors: FileZilla Products: FileZilla Problem Types: CWE-426 Description: Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-14 - https://svn.filezilla-project.org/filezilla?view=revision&revision=9112 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7WUJWTJA55ILACKLTJFSQUYEBHVYENL/ - https://security.gentoo.org/glsa/20
ckage-announce%40lists.fedoraproject.org/message/R7WUJWTJA55ILACKLTJFSQUYEBHVYENL/ - https://security.gentoo.org/glsa/202007-51 - https://lists.debian.org/debian-lts-announce/2022/05/msg00037.html
CVE ID: CVE-2019-5430 State: PUBLISHED Published: 2019-05-06T16:53:50 Last Updated: 2024-08-04T19:54:53.509Z Vendors: n/a Products: UniFi Video Server Problem Types: CWE-352 Description: In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without the user consent, requiring the attacker to lure an authenticated user to access on attacker controlled page. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/329749 - https://community.ubnt.com/t5/UniFi-Video-Blog/UniFi-Video-3-10-1-Soft-Release/ba-p/2658279
CVE ID: CVE-2019-5431 State: PUBLISHED Published: 2019-05-06T16:47:30 Last Updated: 2024-08-04T19:54:53.461Z Vendors: n/a Products: Twitter Kit for iOS Problem Types: CWE-352 Description: This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide alternate credentials. In the final step of "Login with Twitter" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the respon
(typically twitterkit-<consumer-key>) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service. Additional Analyst Notes: - CVE Program Container: References: - https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html
CVE ID: CVE-2019-5432 State: PUBLISHED Published: 2019-05-06T16:48:23 Last Updated: 2024-08-04T19:54:53.491Z Vendors: n/a Products: mqtt-packet Problem Types: CWE-126 Description: A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/541354
CVE ID: CVE-2019-5433 State: PUBLISHED Published: 2019-05-06T16:51:54 Last Updated: 2024-08-04T19:54:53.436Z Vendors: n/a Products: Revive Adserver Problem Types: CWE-601 Description: A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would eventually lead them to another (unsafe) domain, potentially used for stealing credentials or other phishing attacks. This vulnerability was addressed in version 4.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2019-001/ - https://hackerone.com/reports/390663
CVE ID: CVE-2019-5434 State: PUBLISHED Published: 2019-05-06T16:53:33 Last Updated: 2024-08-04T19:54:53.553Z Vendors: n/a Products: Revive Adserver Problem Types: CWE-502 Description: An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to thir
sed by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/512076 - https://hackerone.com/reports/542670 - https://www.revive-adserver.com/security/revive-sa-2019-001/ - http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
CVE ID: CVE-2019-5435 State: PUBLISHED Published: 2019-05-28T18:44:01 Last Updated: 2024-08-04T19:54:53.476Z Vendors: curl Products: curl Problem Types: CWE-131 Description: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/ - https://security.gentoo.org/glsa/202003-29 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alert
l - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://curl.haxx.se/docs/CVE-2019-5435.html - https://security.netapp.com/advisory/ntap-20190606-0004/ - https://support.f5.com/csp/article/K08125515
CVE ID: CVE-2019-5436 State: PUBLISHED Published: 2019-05-28T18:47:32 Last Updated: 2024-08-04T19:54:53.472Z Vendors: curl Products: curl Problem Types: CWE-122 Description: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/ - http://www.openwall.com/lists/oss-secu
ge-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/ - http://www.openwall.com/lists/oss-security/2019/09/11/6 - https://www.debian.org/security/2020/dsa-4633 - https://seclists.org/bugtraq/2020/Feb/36 - https://security.gentoo.org/glsa/202003-29 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20190606-0004/ - https://curl.haxx.se/docs/CVE-2019-5436.html - https://support.f5.com/csp/article/K55133295 - https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_me
://support.f5.com/csp/article/K55133295 - https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-5437 State: PUBLISHED Published: 2019-05-10T21:07:37 Last Updated: 2024-08-04T19:54:53.483Z Vendors: n/a Products: harp Problem Types: CWE-548 Description: Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to the harp server rules.Vulnerable versions are <= 0.29.0 and no fix was applied to our knowledge. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/453820
CVE ID: CVE-2019-5438 State: PUBLISHED Published: 2019-05-10T21:06:31 Last Updated: 2024-08-04T19:54:53.480Z Vendors: n/a Products: harp Problem Types: CWE-22 Description: Path traversal using symlink in npm harp module versions <= 0.29.0. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/530289
CVE ID: CVE-2019-5439 State: PUBLISHED Published: 2019-06-13T15:38:36 Last Updated: 2024-08-04T19:54:53.470Z Vendors: n/a Products: VLC Media Player Problem Types: CWE-120 Description: A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/484398 - http://www.securityfocus.com/bid/108769 - https://usn.ubuntu.com/4074-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - http://lists.opensuse.org/opensuse-security
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html - https://security.gentoo.org/glsa/201908-23 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html