Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15707 State: PUBLISHED Published: 2020-01-23T17:47:00 Last Updated: 2024-10-25T14:04:11.290Z Vendors: n/a Products: Fortinet FortiMail Problem Types: Improper Access Control Description: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-237
CVE ID: CVE-2019-15708 State: PUBLISHED Published: 2020-03-15T22:27:49 Last Updated: 2024-10-25T14:25:55.858Z Vendors: Fortinet Products: Fortinet FortiAP-S/W2, Fortinet FortiAP-U, Fortinet FortiAP Problem Types: Execute unauthorized code or commands Description: A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-209
CVE ID: CVE-2019-15709 State: PUBLISHED Published: 2020-06-01T18:37:21 Last Updated: 2024-10-25T14:01:51.126Z Vendors: n/a Products: Fortinet FortiAP-S/W2, FortiAP-U Problem Types: Execute unauthorized code or commands Description: An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-298
CVE ID: CVE-2019-15710 State: PUBLISHED Published: 2019-10-31T19:26:14 Last Updated: 2024-10-25T14:28:08.293Z Vendors: Fortinet Products: FortiExtender Problem Types: Execute unauthorized code or commands Description: An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-273
CVE ID: CVE-2019-15711 State: PUBLISHED Published: 2020-02-06T15:10:07 Last Updated: 2024-10-25T14:27:08.060Z Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Escalation of privilege Description: A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted "ExportLogs" type IPC client requests to the fctsched process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefence.dk/blog/forticlient_linux
CVE ID: CVE-2019-15712 State: PUBLISHED Published: 2020-01-23T17:40:40 Last Updated: 2024-10-25T14:27:19.700Z Vendors: n/a Products: Fortinet FortiMail Problem Types: Improper Access Control Description: An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-237
CVE ID: CVE-2019-15713 State: PUBLISHED Published: 2019-08-28T11:46:49 Last Updated: 2024-08-05T00:56:22.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: The my-calendar plugin before 3.1.10 for WordPress has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/my-calendar/#developers
CVE ID: CVE-2019-15714 State: PUBLISHED Published: 2019-08-28T11:45:43 Last Updated: 2024-08-05T00:56:22.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/entropic-dev/entropic/issues/251
CVE ID: CVE-2019-15715 State: PUBLISHED Published: 2019-10-09T19:20:28 Last Updated: 2024-08-05T00:56:22.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/changelog_page.php?project=mantisbt - https://mantisbt.org/bugs/view.php?id=26091 - https://github.com/mantisbt/mantisbt/commit/fc7668c8e45db55fc3a4b991ea99d2b80861a14c - https://github.com/mantisbt/mantisbt/commit/5fb979604d88c630343b3eaf2b435cd41918c501 - https://mantisbt.org/bugs/view.php?id=26162 - https://github.com/man
t/commit/5fb979604d88c630343b3eaf2b435cd41918c501 - https://mantisbt.org/bugs/view.php?id=26162 - https://github.com/mantisbt/mantisbt/commit/7092573fac31eff41823f13540324db167c8bd52 - https://github.com/mantisbt/mantisbt/commit/cebfb9acb3686e8904d80bd4bc80720b54ba08e5 - http://packetstormsecurity.com/files/159219/Mantis-Bug-Tracker-2.3.0-Remote-Code-Execution.html
CVE ID: CVE-2019-15716 State: PUBLISHED Published: 2019-08-28T14:13:40 Last Updated: 2024-08-05T00:56:22.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0 - https://github.com/wtfutil/wtf/issues/517 - https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72
CVE ID: CVE-2019-15717 State: PUBLISHED Published: 2019-08-29T16:07:24 Last Updated: 2024-08-05T00:56:22.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP. Additional Analyst Notes: - CVE Program Container: References: - https://irssi.org/security/irssi_sa_2019_08.txt - http://www.openwall.com/lists/oss-security/2019/08/29/3 - http://www.openwall.com/lists/oss-security/2019/08/29/5 - https://usn.ubuntu.com/4119-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDDRTNKDDO52CO5USJ73BE6XVG7BD4KP/
CVE ID: CVE-2019-15718 State: PUBLISHED Published: 2019-09-04T11:04:31 Last Updated: 2024-08-05T00:56:22.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1746057 - http://
onal Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1746057 - http://www.openwall.com/lists/oss-security/2019/09/03/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2WNHRJW4XI6H5YMDG4BUFGPAXWUMUVG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIKGKXZ5OEGOEYURHLJHEMFYNLEGAW5B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRE5IS24XTF5WNZGH2L7GSQJKARBOEGL/ - https://access.redhat.com/errata/RHSA-2019:3592 - https://access.redhat.com/errata/RHSA-2019:3941
CVE ID: CVE-2019-15719 State: PUBLISHED Published: 2019-10-09T11:52:17 Last Updated: 2024-08-05T00:56:22.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pbs_mom, which fails to properly authenticate the message. This results in code execution as an arbitrary user. Additional Analyst Notes: - CVE Program Container: References: - https://www.pbspro.org/ - https://www.hpcsec.com - https://www.hpcsec.com/2019/10/08/cve-2019-15719/ - http://packetstormsecurity.com/files/154782/PBS-Professional-19.2.3-Authentication-Bypass.html
CVE ID: CVE-2019-15720 State: PUBLISHED Published: 2019-08-28T16:29:15 Last Updated: 2024-08-05T00:56:22.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/243-cloudberry-backup-local-privilege-escalation
CVE ID: CVE-2019-15721 State: PUBLISHED Published: 2019-09-16T16:43:56 Last Updated: 2024-08-05T00:56:22.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61981 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15722 State: PUBLISHED Published: 2019-09-16T16:45:27 Last Updated: 2024-08-05T00:56:22.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61410 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15723 State: PUBLISHED Published: 2019-09-16T16:46:46 Last Updated: 2024-08-05T00:56:22.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ee/issues/11302 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15724 State: PUBLISHED Published: 2019-09-16T16:48:53 Last Updated: 2024-08-05T00:56:22.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/60888 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15725 State: PUBLISHED Published: 2019-09-16T16:50:18 Last Updated: 2024-08-05T00:56:22.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ee/issues/11431 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15726 State: PUBLISHED Published: 2019-09-16T16:51:43 Last Updated: 2024-08-05T00:56:22.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/55115 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15727 State: PUBLISHED Published: 2019-09-16T16:53:03 Last Updated: 2024-08-05T00:56:22.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ee/issues/11426 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15728 State: PUBLISHED Published: 2019-09-16T16:54:28 Last Updated: 2024-08-05T00:56:22.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61314 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15729 State: PUBLISHED Published: 2019-09-17T14:34:48 Last Updated: 2024-08-05T00:56:22.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/62073 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15730 State: PUBLISHED Published: 2019-09-16T16:57:33 Last Updated: 2024-08-05T00:56:22.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61349 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-r
lab.com/gitlab-org/gitlab-ce/issues/61349 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15731 State: PUBLISHED Published: 2019-09-16T16:58:39 Last Updated: 2024-08-05T00:56:22.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/60465 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15732 State: PUBLISHED Published: 2019-09-16T16:59:34 Last Updated: 2024-08-05T00:56:22.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/57015 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15733 State: PUBLISHED Published: 2019-09-16T17:00:24 Last Updated: 2024-08-05T00:56:22.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61210 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15734 State: PUBLISHED Published: 2019-09-16T17:01:20 Last Updated: 2024-08-05T00:56:22.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/64711 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15736 State: PUBLISHED Published: 2019-09-16T17:02:11 Last Updated: 2024-08-05T00:56:22.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/51401 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15737 State: PUBLISHED Published: 2019-09-16T17:02:54 Last Updated: 2024-08-05T00:56:22.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/42733 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15738 State: PUBLISHED Published: 2019-09-16T17:03:36 Last Updated: 2024-08-05T00:56:22.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/63124 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15739 State: PUBLISHED Published: 2019-09-16T17:04:23 Last Updated: 2024-08-05T00:56:22.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/64033 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15740 State: PUBLISHED Published: 2019-09-16T17:05:15 Last Updated: 2024-08-05T00:56:22.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-ce/issues/61390 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15741 State: PUBLISHED Published: 2019-09-16T17:06:35 Last Updated: 2024-08-05T00:56:22.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4380 - https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/ - http://seclists.org/fulldisclosure/2019/Oct/7 - http://packetstormsecurity.com/files/154734/GitLab-Omnibus-12.2.1-Logrotate-Privilege-Escalation.html
CVE ID: CVE-2019-15742 State: PUBLISHED Published: 2020-01-16T23:15:20 Last Updated: 2024-08-05T00:56:22.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this issue to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155952/Plantronics-Hub-SpokesUpdateService-Privilege-Escalation.html
CVE ID: CVE-2019-15743 State: PUBLISHED Published: 2019-11-14T16:27:54 Last Updated: 2024-08-05T00:56:22.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sony Xperia Touch Android device with a build fingerprint of Sony/blanc_windy/blanc_windy:7.0/LOIRE-SMART-BLANC-1.0.0-170530-0834/1:user/dev-keys contains a pre-installed app with a package name of com.sonymobile.android.maintenancetool.testmic app (versionCode=24, versionName=7.0) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record audio to external stora
co-located on the device. This app allows a third-party app to use its open interface to record audio to external storage. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15744 State: PUBLISHED Published: 2019-11-14T16:19:46 Last Updated: 2024-08-05T00:56:22.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sony Xperia Xperia XZs Android device with a build fingerprint of Sony/keyaki_softbank/keyaki_softbank:7.1.1/TONE3-3.0.0-SOFTBANK-170517-0323/1:user/dev-keys contains a pre-installed app with a package name of jp.softbank.mb.tdrl app (versionCode=1413005, versionName=1.3.0) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/andro
located on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/android-firmware-2019/
CVE ID: CVE-2019-15745 State: PUBLISHED Published: 2019-08-29T12:40:53 Last Updated: 2024-08-05T00:56:22.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off. Additional Analyst Notes: - CVE Program Container: References: - https://www.ckn.io/blog/2019/08/27/exploiting-the-eques-elf-smart-