Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
R324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60
ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIMATIC
V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIMATIC CP 343-1 Advanced, SIMATIC CP 442-1 RNA, SIMATIC CP 443-1, SIMATIC CP 443-1, SIMATIC CP 443-1 Advanced, SIMATIC CP 443-1 RNA, SIMATIC RF180C, SIMATIC RF182C, SIPLUS NET CP 343-1 Advanced, SIPLUS NET CP 443-1, SIPLUS NET CP 443-1 Advanced, SIPLUS NET SCALANCE X308-2. The VxWorks-based Profinet TCP Stack can be forced to make very expensive calls for every incoming packet which can lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-102233.pdf
CVE ID: CVE-2019-19306 State: PUBLISHED Published: 2019-11-26T14:58:56 Last Updated: 2024-08-05T02:16:46.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9919 - https://github.com/cybersecurityworks/Disclosed/issues/16 - https://wordpress.org/plugins/zoho-crm-forms/#developers - https://cybersecurityworks.com/zerodays/cve-2019-19306-zoho.html
CVE ID: CVE-2019-19307 State: PUBLISHED Published: 2019-11-26T15:15:04 Last Updated: 2024-08-05T02:16:46.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cesanta/mongoose/issues/1055
CVE ID: CVE-2019-19308 State: PUBLISHED Published: 2019-11-27T14:37:38 Last Updated: 2024-08-05T02:16:46.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117 - https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17
CVE ID: CVE-2019-19309 State: PUBLISHED Published: 2020-01-03T16:38:26 Last Updated: 2024-08-05T02:16:46.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19310 State: PUBLISHED Published: 2020-01-03T16:39:35 Last Updated: 2024-08-05T02:16:46.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19311 State: PUBLISHED Published: 2020-01-03T15:22:22 Last Updated: 2024-08-05T02:16:47.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab/issues/31536 - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19312 State: PUBLISHED Published: 2020-01-05T21:37:15 Last Updated: 2024-08-05T02:16:46.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still able to get information about the private project through the API. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab/issues/28802 - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19313 State: PUBLISHED Published: 2020-01-05T21:42:26 Last Updated: 2024-08-05T02:16:46.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and commits. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab/issues/14947 - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19314 State: PUBLISHED Published: 2020-01-05T21:47:51 Last Updated: 2024-08-05T02:16:46.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab/issues/32381 - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/
CVE ID: CVE-2019-19315 State: PUBLISHED Published: 2019-12-17T14:44:30 Last Updated: 2024-08-05T02:16:47.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailslot mailslot. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monoxgas/mailorder
CVE ID: CVE-2019-19316 State: PUBLISHED Published: 2019-12-02T20:50:44 Last Updated: 2024-08-05T02:16:46.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626
CVE ID: CVE-2019-19317 State: PUBLISHED Published: 2019-12-05T13:53:16 Last Updated: 2024-08-05T02:16:46.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sqlite/sqlite/commit/73bacb7f93eab9f4bd5a65cbc4ae242acf63c9e3 - https://github.com/sqlite/sqlite/commit/522ebfa7cee96fb325a22ea3a2464a63485886a8 - https://security.netapp.com/advisory/ntap-20191223-0001/ - https://www.oracle.com/security-al
25a22ea3a2464a63485886a8 - https://security.netapp.com/advisory/ntap-20191223-0001/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2019-19318 State: PUBLISHED Published: 2019-11-27T23:41:36 Last Updated: 2024-08-05T02:16:47.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318 - https://security.netapp.com/advisory/ntap-20200103-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html - https://usn.ubuntu.com/4414-1/ - h
-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html - https://usn.ubuntu.com/4414-1/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE ID: CVE-2019-19319 State: PUBLISHED Published: 2019-11-27T22:48:19 Last Updated: 2024-08-05T02:16:46.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call, aka CID-345c0dbf3a30. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19319 - https://security.netapp.com/advisory/ntap-20200103-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/ms
tps://security.netapp.com/advisory/ntap-20200103-0001/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://usn.ubuntu.com/4391-1/ - https://bugzilla.suse.com/show_bug.cgi?id=1158021 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=345c0dbf3a30
CVE ID: CVE-2019-19324 State: PUBLISHED Published: 2020-03-20T17:26:52 Last Updated: 2024-08-05T02:16:46.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xmidt-org/cjwt/commit/9304d3e94242c1a6df77b21bde0e949392e1040a - https://github.com/xmidt-org/cjwt/pull/29#issuecomment-558356866
CVE ID: CVE-2019-19325 State: PUBLISHED Published: 2020-02-17T19:59:29 Last Updated: 2024-08-05T02:16:46.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/downloa
sitive user input. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/cve-2019-19325
CVE ID: CVE-2019-19326 State: PUBLISHED Published: 2020-07-15T18:54:55 Last Updated: 2024-08-05T02:16:46.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return unexpected responses to other consumers of this cached response. Most other headers associated with web cache poisoning are already disabled through request hostname forgery whitelists. Additional Analyst Notes: - CVE Program Container: Re
are already disabled through request hostname forgery whitelists. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/CVE-2019-19326
CVE ID: CVE-2019-19327 State: PUBLISHED Published: 2019-11-27T15:28:38 Last Updated: 2024-08-05T02:16:46.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.wikimedia.org/r/#/c/553311/ - https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html - https://gerrit.wikimedia.org/g/wikidata/query/gu
lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html - https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d
CVE ID: CVE-2019-19328 State: PUBLISHED Published: 2019-11-27T15:28:25 Last Updated: 2024-08-05T02:16:46.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.wikimedia.org/r/#/c/553311/ - https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html - https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f
ikidata-tech/2019-November/001503.html - https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d
CVE ID: CVE-2019-19329 State: PUBLISHED Published: 2019-11-27T15:28:10 Last Updated: 2024-08-05T02:16:46.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T233213 - https://gerrit.wikimedia.org/r/#/c/
: - CVE Program Container: References: - https://phabricator.wikimedia.org/T233213 - https://gerrit.wikimedia.org/r/#/c/wikidata/query/gui/+/549457/ - https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001492.html - https://gerrit.wikimedia.org/g/wikidata/query/gui/+/d9f964b88c01748e278ca8c4b8929a8ef0ef0267
CVE ID: CVE-2019-19330 State: PUBLISHED Published: 2019-11-27T15:53:26 Last Updated: 2024-08-05T02:16:46.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks. Additional Analyst Notes: - CVE Program Container: References: - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=54f53ef7ce4102be596130b44c768d1818570344 - https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 - https://git.haproxy.org/?p=haproxy-2.0.gi
y.org/?p=haproxy.git%3Ba=commit%3Bh=146f53ae7e97dbfe496d0445c2802dd0a30b0878 - https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=ac198b92d461515551b95daae20954b3053ce87e - https://tools.ietf.org/html/rfc7540#section-10.3 - https://www.debian.org/security/2019/dsa-4577 - https://seclists.org/bugtraq/2019/Nov/45 - https://usn.ubuntu.com/4212-1/ - https://security.gentoo.org/glsa/202004-01
CVE ID: CVE-2019-19331 State: PUBLISHED Published: 2019-12-16T00:00:00 Last Updated: 2024-08-05T02:16:46.880Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: CZ.NIC Products: knot-resolver Problem Types: CWE-407 Description: knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for each such uncached message. For example, a few thousand A records can be squashed into one DNS message (limit is 64kB). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redha
one DNS message (limit is 64kB). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19331 - https://www.knot-resolver.cz/2019-12-04-knot-resolver-4.3.0.html - https://lists.debian.org/debian-lts-announce/2024/04/msg00017.html
CVE ID: CVE-2019-19332 State: PUBLISHED Published: 2020-01-09T14:41:03 Last Updated: 2024-08-05T02:16:47.112Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-787 Description: An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://
the system, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19332 - https://www.openwall.com/lists/oss-security/2019/12/16/1 - https://lore.kernel.org/kvm/000000000000ea5ec20598d90e50%40google.com/ - http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://usn.ubuntu.com/4254-1/ - https://usn.ubuntu.com/4254-2/ - https://security.netapp.com/advisory/ntap-20200204-0002/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/428
isory/ntap-20200204-0002/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html - https://usn.ubuntu.com/4284-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html
CVE ID: CVE-2019-19333 State: PUBLISHED Published: 2019-12-06T15:19:58 Last Updated: 2024-08-05T02:16:46.793Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: libyang Problem Types: CWE-121 Description: In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=
execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19333 - https://github.com/CESNET/libyang/commit/f6d684ade99dd37b21babaa8a856f64faa1e2e0d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/ - https://access.redhat.com/errata/RHSA-2019:4360
CVE ID: CVE-2019-19334 State: PUBLISHED Published: 2019-12-06T15:22:19 Last Updated: 2024-08-05T02:16:46.899Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: libyang Problem Types: CWE-121 Description: In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.
n code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334 - https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL/ - https://access.redhat.com/errata/RHSA-2019:4360
CVE ID: CVE-2019-19335 State: PUBLISHED Published: 2020-03-18T15:45:41 Last Updated: 2024-08-05T02:16:46.713Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: openshift/installer Problem Types: CWE-732 Description: During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https:/
ller as shipped in Openshift 4.2 is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19335
CVE ID: CVE-2019-19336 State: PUBLISHED Published: 2020-03-19T13:11:16 Last Updated: 2024-08-05T02:16:47.108Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: ovirt-engine Problem Types: CWE-79 Description: A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-1933
ditional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19336