Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18890 State: PUBLISHED Published: 2019-11-21T17:46:41 Last Updated: 2024-08-05T02:02:39.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://security-tracker.debian.org/tracker/CVE-2019-18890 - https://www.debian.org/security/2019/dsa-4574 - https://seclists.org/bugtraq/2019/Nov/31 - https://www.debian.org/security/2019/dsa-4574 - https://usn.ubuntu.com/4200-1/ - https
eclists.org/bugtraq/2019/Nov/31 - https://www.debian.org/security/2019/dsa-4574 - https://usn.ubuntu.com/4200-1/ - https://github.com/RealLinkers/CVE-2019-18890
CVE ID: CVE-2019-18893 State: PUBLISHED Published: 2020-01-13T16:09:50 Last Updated: 2024-08-05T02:02:39.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways. Additional Analyst Notes: - CVE Program Container: References: - htt
their surfing experience in almost arbitrary ways. Additional Analyst Notes: - CVE Program Container: References: - https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
CVE ID: CVE-2019-18894 State: PUBLISHED Published: 2020-01-13T16:13:02 Last Updated: 2024-08-05T02:02:39.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently logged in user. This allows for example attackers who compromised a browser extension to escape from the browser sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://palant.de/2020/01/13/pwning-avast-secu
sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/
CVE ID: CVE-2019-18895 State: PUBLISHED Published: 2019-11-14T14:00:16 Last Updated: 2024-08-05T02:02:39.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable file. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org - https://support.scanguard.com/en/kb/22/upgrades-available - https://packetstormsecurity.com/files/155319/ScanGuard-Antivirus-Insecure-Permissions.html - http://seclists.org/fulldisclosure/2019/Nov/5
CVE ID: CVE-2019-18897 State: PUBLISHED Published: 2020-03-02T15:20:27.294803Z Last Updated: 2024-09-17T01:21:20.067Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, Factory Problem Types: CWE-59 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise S
ffects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html - https://bugzilla.suse.com/show_bug.cgi?id=1157465
CVE ID: CVE-2019-18898 State: PUBLISHED Published: 2020-01-23T14:05:14.446560Z Last Updated: 2024-09-16T18:24:53.684Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 15 SP1, Factory Problem Types: CWE-59 Description: UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1. Additional Analyst Notes: - CVE Program Con
ior to 0.3.14-6.3.1. openSUSE Factory trousers versions prior to 0.3.14-7.1. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00066.html - https://bugzilla.suse.com/show_bug.cgi?id=1157651
CVE ID: CVE-2019-18899 State: PUBLISHED Published: 2020-01-23T15:00:20.234353Z Last Updated: 2024-09-17T01:25:34.093Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: openSUSE Products: Leap 15.1 Problem Types: CWE-269 Description: The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html -
tes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html - https://bugzilla.suse.com/show_bug.cgi?id=1157703
CVE ID: CVE-2019-18900 State: PUBLISHED Published: 2020-01-24T15:15:15.806052Z Last Updated: 2024-09-16T20:52:26.745Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 Problem Types: CWE-276 Description: : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp ve
ue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1158763 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00005.html
CVE ID: CVE-2019-18901 State: PUBLISHED Published: 2020-03-02T16:10:13.772559Z Last Updated: 2024-09-17T01:16:43.090Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: SUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 Problem Types: CWE-59 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariad
ffects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html - https://bugzilla.suse.com/show_bug.cgi?id=1160895
CVE ID: CVE-2019-18902 State: PUBLISHED Published: 2020-03-02T16:45:18.218099Z Last Updated: 2024-09-17T02:41:08.903Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, Leap 15.1, Factory Problem Types: CWE-416 Description: A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.
Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1160903
CVE ID: CVE-2019-18903 State: PUBLISHED Published: 2020-03-02T16:45:18.618041Z Last Updated: 2024-09-17T01:00:28.473Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, Leap 15.1, Factory Problem Types: CWE-416 Description: A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0
Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1160904
CVE ID: CVE-2019-18904 State: PUBLISHED Published: 2020-04-03T07:10:13.137414Z Last Updated: 2024-09-16T16:58:59.728Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, openSUSE Leap 15.1 Problem Types: CWE-400 Description: A Uncontrolled Resource Consumption vulnerability in
for SAP 15, openSUSE Leap 15.1 Problem Types: CWE-400 Description: A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5
grations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE L
ons prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1160922
CVE ID: CVE-2019-18905 State: PUBLISHED Published: 2020-04-03T11:00:16.880502Z Last Updated: 2024-09-17T02:52:07.503Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: SUSE Products: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 Problem Types: CWE-345 Description: A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Ente
s. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1140711 - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00050.html
CVE ID: CVE-2019-18906 State: PUBLISHED Published: 2021-06-30T08:35:12.084787Z Last Updated: 2024-09-16T21:03:41.876Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 Problem Types: CWE-287 Description: A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4. Additional A
rver for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1186226
CVE ID: CVE-2019-18909 State: PUBLISHED Published: 2019-11-22T21:38:59 Last Updated: 2024-08-05T02:02:39.803Z Vendors: HP Products: ThinPro Linux Problem Types: Privileged Command Injection Description: The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/39 - http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html
CVE ID: CVE-2019-18910 State: PUBLISHED Published: 2019-11-22T21:23:52 Last Updated: 2024-08-05T02:02:39.924Z Vendors: HP Products: ThinPro Linux Problem Types: Command Injection Description: The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/40 - http://packetstormsecurity.com/files/156909/HP-ThinPro-6.x-7.x-Privileged-Command-Injection.html
CVE ID: CVE-2019-18912 State: PUBLISHED Published: 2021-11-09T14:55:11 Last Updated: 2024-08-05T02:02:39.846Z Vendors: n/a Products: HP LaserJet Enterprise Printers Problem Types: Potential instability of solution Description: A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affected printers with FutureSmart Firmware bundle version 4.9 or 4.9.0.1 the potential vulnerability may cause instability in the solution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06513924
CVE ID: CVE-2019-18913 State: PUBLISHED Published: 2020-01-31T03:04:11 Last Updated: 2024-08-05T02:02:39.823Z Vendors: HP Inc. Products: HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Problem Types: Possible Arbitrary Code Execution, Denial of Service, Information Disclosure. Description: A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protectio
ify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02). Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06549501
CVE ID: CVE-2019-18914 State: PUBLISHED Published: 2021-11-09T14:10:15 Last Updated: 2024-08-05T02:02:39.700Z Vendors: n/a Products: HP Color LaserJet Managed Printers, HP Color LaserJet Enterprise Printers Problem Types: Cross-Site Scripting Description: A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s browser by clicking on a third-party malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06546034
CVE ID: CVE-2019-18915 State: PUBLISHED Published: 2020-02-12T23:04:31 Last Updated: 2024-08-05T02:02:39.795Z Vendors: n/a Products: HP System Event Utility Problem Types: Execution of Arbitrary Code. Description: A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to execute arbitrary code via an HP System Event Utility system service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06559359 - http://seclists.org/fulldisclosure/2020/Feb/8
CVE ID: CVE-2019-18916 State: PUBLISHED Published: 2021-11-09T13:58:27 Last Updated: 2024-08-05T02:02:39.865Z Vendors: n/a Products: HP Color LaserJet Pro MFP M277 printers Problem Types: elevation of privilege Description: A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elevation of privilege on the client. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06586963
CVE ID: CVE-2019-18917 State: PUBLISHED Published: 2020-03-16T19:53:54 Last Updated: 2024-08-05T02:02:39.929Z Vendors: n/a Products: HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B) Problem Types: Account lockout bypass. Description: A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06594863
CVE ID: CVE-2019-18922 State: PUBLISHED Published: 2019-11-29T18:51:44 Last Updated: 2024-08-05T02:02:39.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/dpEGKUGz - http://seclists.org/fulldisclosure/2019/Nov/31 - http://packetstormsecurity.com/files/155504/Allied-Telesis-AT-GS950-8-Directory-Traversal.html
CVE ID: CVE-2019-18923 State: PUBLISHED Published: 2019-11-13T21:11:01 Last Updated: 2024-08-05T02:02:39.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cactus/go-camo/blob/505862f7bf14c8b6ff945734d5f3fdcd929e45dd/pkg/camo/proxy.go#L453-L460 - https://github.com/cactus/go-camo/security/advisories/GHSA-jg2r-qf99-4wvr
CVE ID: CVE-2019-18924 State: PUBLISHED Published: 2019-11-12T16:15:26 Last Updated: 2024-08-05T02:02:39.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations), it is possible to list all the directories and check if a particular file exists. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vulnerabilities-cve/vulnerabilities
CVE ID: CVE-2019-18925 State: PUBLISHED Published: 2019-11-12T16:15:53 Last Updated: 2024-08-05T02:02:39.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vulnerabilities-cve/vulnerabilities
CVE ID: CVE-2019-18926 State: PUBLISHED Published: 2019-11-12T16:15:42 Last Updated: 2024-08-05T02:02:39.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog information) is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack against users of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vulnerabilities-cve/vulnerabilities
CVE ID: CVE-2019-18928 State: PUBLISHED Published: 2019-11-15T03:45:16 Last Updated: 2024-08-05T02:02:39.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.12.html - https://www.cyrusimap.org/imap/download/release-notes/2.5/x/2.5.14.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
e-notes/2.5/x/2.5.14.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHV3TUU53WCKJ3BBRK2EHAF44MSZEFK6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAGKPZDXQ6KRUGQVRAO6N4PCINP6KS5F/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00013.html