Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-11303 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11304 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11305 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11306 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11307 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11308 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11309 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11310 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.
CVE ID: CVE-2019-11311 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11312 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11313 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11314 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11315 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11316 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11317 State: REJECTED Published: 2021-01-25T17:19:34 Last Updated: 2021-01-25T17:19:34 Description: No description available.
CVE ID: CVE-2019-11318 State: PUBLISHED Published: 2020-01-27T18:23:27 Last Updated: 2024-08-04T22:48:09.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://bugzilla.zimbra.com/show_bug.cgi?id=109117 - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.12/P1
CVE ID: CVE-2019-11319 State: PUBLISHED Published: 2019-04-18T16:46:36 Last Updated: 2024-08-04T22:48:09.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code execution via shell metacharacters in a JSON value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf
CVE ID: CVE-2019-11320 State: PUBLISHED Published: 2019-04-18T16:47:00 Last Updated: 2024-08-04T22:48:09.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf
CVE ID: CVE-2019-11321 State: PUBLISHED Published: 2019-04-18T16:47:34 Last Updated: 2024-08-04T22:48:09.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to obtain information such as the MAC addresses of connected client devices. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf
CVE ID: CVE-2019-11322 State: PUBLISHED Published: 2019-04-18T16:47:47 Last Updated: 2024-08-04T22:48:09.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execution via shell metacharacters in a JSON value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/iot/motorola.pdf
CVE ID: CVE-2019-11323 State: PUBLISHED Published: 2019-05-09T13:42:28 Last Updated: 2024-08-04T22:48:09.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include/types/ssl_sock.h error. Additional Analyst Notes: - CVE Program Container: References: - http://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=8ef706502aa2000531d36e4ac56dbdc7c30f718d - https://www.mail-archive.com/haproxy%40formilux.org/msg33410.html
CVE ID: CVE-2019-11324 State: PUBLISHED Published: 2019-04-18T00:00:00 Last Updated: 2024-08-04T22:48:09.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 - http://www.openwall.com/lists/oss-security/2019/04/
es: - https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 - http://www.openwall.com/lists/oss-security/2019/04/19/1 - https://usn.ubuntu.com/3990-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html - https://access.redhat.com/errata/RHSA-2019:3590 - https://access.redhat.com/errata/RHSA-2019:3335 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/ - https://lists.debian
rchives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
CVE ID: CVE-2019-11325 State: PUBLISHED Published: 2019-11-21T22:15:55 Last Updated: 2024-08-04T22:48:09.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3 - https://symfony.com/blog/symfony-4-3-8-released - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/cve-2019-11325
ymfony-4-3-8-released - https://github.com/symfony/symfony/releases/tag/v4.3.8 - https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
CVE ID: CVE-2019-11326 State: PUBLISHED Published: 2019-09-20T18:19:08 Last Updated: 2024-08-04T22:48:09.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration. Additional Analyst Notes: - CVE Program Container: References: - https://mezdanak.de/2019/06/21/iot-full-disc
iguration. Additional Analyst Notes: - CVE Program Container: References: - https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/
CVE ID: CVE-2019-11327 State: PUBLISHED Published: 2019-09-20T18:24:50 Last Updated: 2024-08-04T22:48:09.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system. Additional Analyst Notes: - CVE Program Container: References: - https://mezdanak.de/2019/06/21/iot-full-disclosure-topcon-positioning-net-g5-receiver/
CVE ID: CVE-2019-11328 State: PUBLISHED Published: 2019-05-14T20:24:29 Last Updated: 2024-08-04T22:48:09.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host. Additional Analyst Notes: - CVE Program Container: References: - https://github.c
tial privilege escalation on the host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sylabs/singularity/releases/tag/v3.2.0 - http://www.openwall.com/lists/oss-security/2019/05/16/1 - http://www.securityfocus.com/bid/108360 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNU5BUHFOTYUZVHFUSX2VG4S3RCPUEMA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3TPL5OOTIZEI4H6IQBCCISBARJ6WL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIHV7DSEVTB5SUPEZ2UXGS3Q6WMEQSO2/ - http://lists.opensuse.org/opensuse-se
age-announce%40lists.fedoraproject.org/message/LIHV7DSEVTB5SUPEZ2UXGS3Q6WMEQSO2/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
CVE ID: CVE-2019-11331 State: PUBLISHED Published: 2019-04-18T21:58:36 Last Updated: 2024-08-04T22:48:09.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks. Additional Analyst Notes: - CVE Program Container: References: - https://tools.ietf.org/html/draft-gont-ntp-port-randomization-00 - http://www.securityfocus.com/bid/108010 - https://support.f5.com/csp/article/K09940637 - https://support.f5.com/csp/article/K09940637?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-11332 State: PUBLISHED Published: 2019-04-18T22:17:14 Last Updated: 2024-08-04T22:48:09.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456. Additional Analyst Notes: - CVE Program Container: References: - https://cisk123456.blogspot.com/2019/04/mkcms-v50.html
CVE ID: CVE-2019-11334 State: PUBLISHED Published: 2019-06-11T17:43:26 Last Updated: 2024-08-04T22:48:09.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources (that are not otherwise accessible without proper authentication) via capture-replay. Physically proximate attackers can use this information to unlock unauthorized Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whitehatdefenses/KlicUnLock - http://packetstormsecurity.com/
- CVE Program Container: References: - https://github.com/whitehatdefenses/KlicUnLock - http://packetstormsecurity.com/files/153280/Tzumi-Electronics-Klic-Lock-Authentication-Bypass.html
CVE ID: CVE-2019-11336 State: PUBLISHED Published: 2019-05-14T13:57:24 Last Updated: 2024-08-04T22:48:09.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Apr/32 - http://packetstormsecurity.com/files/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html - https://seclists.org/bugtraq/2019/Apr/34 - http://www.s
les/152612/Sony-Smart-TV-Information-Disclosure-File-Read.html - https://seclists.org/bugtraq/2019/Apr/34 - http://www.securityfocus.com/bid/108072 - https://www.darkmatter.ae/xen1thlabs/sony-smart-tv-photo-sharing-plus-information-disclosure-vulnerability-xl-19-003/
CVE ID: CVE-2019-11338 State: PUBLISHED Published: 2019-04-18T23:52:00 Last Updated: 2024-08-04T22:48:09.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/54655623a82632e7624714d7b2a3e039dc5faa7e - http://www.securityfocus.com/bid/108034 - https://usn.ubuntu.com/3967-1/ - https://seclists.org/bugtraq/2019/May/60
7e - http://www.securityfocus.com/bid/108034 - https://usn.ubuntu.com/3967-1/ - https://seclists.org/bugtraq/2019/May/60 - https://www.debian.org/security/2019/dsa-4449 - https://lists.debian.org/debian-lts-announce/2019/05/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html - https://usn.ubuntu.com/4431-1/ - https://github.com/FFmpeg/FFmpeg/commit/9ccc633068c6fe76989f487c8932bd11886ad65b
CVE ID: CVE-2019-11339 State: PUBLISHED Published: 2019-04-18T23:52:15 Last Updated: 2024-08-04T22:48:09.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/d227ed5d598340e719eff7156b1aa0a4469e9a6a - https://github.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb - http://www.securityfocus.com/bid/108037 - https
thub.com/FFmpeg/FFmpeg/commit/1f686d023b95219db933394a7704ad9aa5f01cbb - http://www.securityfocus.com/bid/108037 - https://usn.ubuntu.com/3967-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00012.html
CVE ID: CVE-2019-11340 State: PUBLISHED Published: 2019-04-19T13:35:36 Last Updated: 2024-08-04T22:48:09.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/matrixdotorg/status/1118934335963500545 - https://matrix.org/blog/2019/04/18/security-update-
ces: - https://twitter.com/matrixdotorg/status/1118934335963500545 - https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/ - https://github.com/matrix-org/sydent/commit/4e1cfff53429c49c87d5c457a18ed435520044fc - https://github.com/matrix-org/sydent/compare/7c002cd...09278fb
CVE ID: CVE-2019-11341 State: PUBLISHED Published: 2019-10-09T15:00:17 Last Updated: 2024-08-04T22:48:09.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode application is available after entering the *#9900# check code, but is protected by an OTP password. However, this password is created locally and (due to mishandling of cryptography) can be obtained easily by reversing the password creation logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - h
itional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://drfone.wondershare.com/unlock/samsung-galaxy-secret-code-list.html - https://twitter.com/fs0c131y/status/1115889065285562368
CVE ID: CVE-2019-11343 State: PUBLISHED Published: 2020-03-12T20:53:27 Last Updated: 2024-08-04T22:48:09.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xjodoin/torpedoquery/commit/3c20b874fba9cc2a78b9ace10208de1602b56c3f - https://github.com/xjodoin/torpedoquery/compare/v2.5.2...v2.5.3
CVE ID: CVE-2019-11344 State: PUBLISHED Published: 2019-04-19T18:20:34 Last Updated: 2024-08-04T22:48:09.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/72
CVE ID: CVE-2019-11345 State: PUBLISHED Published: 2020-03-10T13:03:02 Last Updated: 2024-08-04T22:48:09.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX247737
CVE ID: CVE-2019-11350 State: PUBLISHED Published: 2019-04-19T20:07:24 Last Updated: 2024-08-04T22:48:09.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure - https://release-notes.cloudbees.com/release/21/8.18 - https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20
/release/21/8.18 - https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure
CVE ID: CVE-2019-11351 State: PUBLISHED Published: 2019-04-19T20:53:20 Last Updated: 2024-08-04T22:48:09.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework. Additional Analyst Notes: - CVE Program Container: References: - https://forum.teamspeak.com/threads/139546-Release-TeamSpeak-3-Client-3-2-5 - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-004.md
CVE ID: CVE-2019-11353 State: PUBLISHED Published: 2019-05-09T13:32:46 Last Updated: 2024-08-04T22:48:09.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute utilities by using different payloads and injecting multiple parameters. This vulnerability is fixed in a later firmware version. Additional Analyst Notes: - CVE Program Container: References: - https://www.engeniustech.com/engenius-products/managed-outdoor-wireless-ews660ap/ - https://securityshards.wordpress.com/2019/04/21/cve-2019-11353-engenius-ews660ap-arbitrary-code-execution/
CVE ID: CVE-2019-11354 State: PUBLISHED Published: 2019-04-19T21:29:05 Last Updated: 2024-08-04T22:48:09.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication. Additional Analyst Notes: - CVE Program Container: References: - https://blog.underdogsecurity.com/rce_in_origin_client/ - https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/ - http://gamasutra.com/view/
om/rce_in_origin_client/ - https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/ - http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.php - https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/ - https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604 - https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clien - https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-client - https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942 - https://www.vg247.com/2019/04/17/ea-origin-se
/time-update-origin-eas-game-client-security-risk-just-installed-3697942 - https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/ - https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.html - http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html - http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.html
CVE ID: CVE-2019-11355 State: PUBLISHED Published: 2020-03-12T20:56:02 Last Updated: 2024-08-04T22:48:09.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root. Additional Analyst Notes: - CVE Program Container: References:
a factor value. A system command can be executed as root. Additional Analyst Notes: - CVE Program Container: References: - https://support.polycom.com/content/dam/polycom-support/global/documentation/hdx-3-1-14-advisory.pdf