Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-8948 State: PUBLISHED Published: 2019-02-20T04:00:00Z Last Updated: 2024-09-16T19:14:55.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. Additional Analyst Notes: - CVE Program Container: References: - https://www.papercut.com/products/mf/release-history/ - https://www.papercut.com/products/ng/release-history/
CVE ID: CVE-2019-8950 State: PUBLISHED Published: 2019-02-20T04:00:00Z Last Updated: 2024-09-16T23:15:26.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Feb/32 - https://blog.burghardt.pl/2019/02/dasan-h665-has-vendor-backdoor-built-into-busyboxs-bin-login/
CVE ID: CVE-2019-8951 State: PUBLISHED Published: 2019-05-13T20:51:33 Last Updated: 2024-08-04T21:31:37.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote attacker to redirect users to an arbitrary URL. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Vide
; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.70.0056 and newer; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; fixed versions: 7.5; 3.70.0056). Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com - https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0401bt-cve-2019-8951_security_advisory_vrm_open_redirect.pdf - https://www.boschsecurity.com/xc/en/support/product-security/security-a
9-8951_security_advisory_vrm_open_redirect.pdf - https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html - https://psirt.bosch.com/Advisory/BOSCH-2019-0401.html
CVE ID: CVE-2019-8952 State: PUBLISHED Published: 2019-05-13T21:14:34 Last Updated: 2024-08-04T21:31:37.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.62.0019 and newer), Bosch DIVAR IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer
IP 5000 (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; fixed versions: 3.80.0033 and newer). Affected software products: Video Recording Manager (VRM) (vulnerable versions: 3.10; 3.20; 3.21; 3.50; 3.51; 3.55; 3.60; 3.61; 3.62; 3.70; 3.71 before 3.71.0032 ; fixed versions: 3.71.0032; 3.81.0032 and newer), Bosch Video Management System (BVMS) (vulnerable versions: 3.50.00XX; 3.55.00XX; 3.60.00XX; 3.70.0056; fixed versions: 7.5; 3.71.0032). Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com - https://www.boschsecurity.com/xc/en/support/product-security/security-advisories.html - https://psirt.bosch.com/Advisory/BOSCH-2019-0402.
security.com/xc/en/support/product-security/security-advisories.html - https://psirt.bosch.com/Advisory/BOSCH-2019-0402.html - https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-2019-0402bt-cve-2019-8952_security_advisory_vrm_path_traversal.pdf
CVE ID: CVE-2019-8953 State: PUBLISHED Published: 2019-02-20T16:00:00 Last Updated: 2024-08-04T21:31:37.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.pfsense.org/issues/9335 - https://github.com/pfsense/FreeBSD-ports/commit/2dded47b3202dfdf89aa96f84bf701b3d5acbe6c - https://cxsecurity.com/issue/WLB-2019020153 - https://github.com/pfsense/FreeBSD-ports/commit/3b40366aca55910b224ecf49d3fdacc9ad6c04f5 - https://www.ex
B-2019020153 - https://github.com/pfsense/FreeBSD-ports/commit/3b40366aca55910b224ecf49d3fdacc9ad6c04f5 - https://www.exploit-db.com/exploits/46538/
CVE ID: CVE-2019-8954 State: PUBLISHED Published: 2019-02-20T17:00:00Z Last Updated: 2024-09-17T01:11:10.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/112/
CVE ID: CVE-2019-8955 State: PUBLISHED Published: 2019-02-21T23:00:00 Last Updated: 2024-08-04T21:31:37.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107136 - https://trac.torproject.org/projects/tor/ticket/29168 - https://blog.torproject.org/new-releases-tor-0402-alpha-0358-03411-and-03312 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013
new-releases-tor-0402-alpha-0358-03411-and-03312 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00013.html
CVE ID: CVE-2019-8956 State: PUBLISHED Published: 2019-04-01T18:39:32 Last Updated: 2024-08-04T21:31:37.498Z Vendors: UNKNOWN Products: Linux Kernel Problem Types: Privilege escalation Description: In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctp_sendmsg()" function (net/sctp/socket.c) when handling SCTP_SENDALL flag can be exploited to corrupt memory. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21 - https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8 - https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5/ - https://git.kernel.org/cgit/linux/kern
g-4.20.8 - https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5/ - https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=ba59fb0273076637f0add4311faa990a5eec27c0 - https://usn.ubuntu.com/3930-1/ - https://usn.ubuntu.com/3930-2/ - https://support.f5.com/csp/article/K12671141
CVE ID: CVE-2019-8960 State: PUBLISHED Published: 2020-04-21T14:20:52 Last Updated: 2024-08-04T21:31:37.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. The message reading function used in lmadmin.exe can, given a certain message, call itself again and then wait for a further message. With a particular flag set in the original message, but no second message received, the function eventually return an unexpected value which leads to an exception being thrown. The end result can be process termination. Additional Analyst Notes: - CVE Program Contai
to an exception being thrown. The end result can be process termination. Additional Analyst Notes: - CVE Program Container: References: - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8960-remediated-in-FlexNet-Publisher/ta-p/124598/jump-to/first-unread-message
CVE ID: CVE-2019-8961 State: PUBLISHED Published: 2020-04-21T14:20:52 Last Updated: 2024-08-04T21:31:37.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading function calls itself recursively given a certain condition in the received message, an unauthenticated remote attacker can repeatedly send messages of that type to cause a stack exhaustion condition. Additional Analyst Notes: - CVE Program Container: References: - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8961-remediated-in-FlexNet-Publisher/ta
es: - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8961-remediated-in-FlexNet-Publisher/ta-p/124601/jump-to/first-unread-message
CVE ID: CVE-2019-8963 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-19T17:19:18.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service (DoS) vulnerability was discovered in FlexNet Publisher's lmadmin 11.16.5, when doing a crafted POST request on lmadmin using the web-based tool. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8963-Remediated-in-FlexNet-Publisher/ta-p/148768
CVE ID: CVE-2019-8978 State: PUBLISHED Published: 2019-05-14T18:37:43 Last Updated: 2024-08-04T21:31:37.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a logi
age with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/May/18 - http://packetstormsecurity.com/files/152856/Ellucian-Banner-Web-Tailor-Banner-Enterprise-Identity-Services-Improper-Authentication.html - https://seclists.org/bugtraq/2019/May/31 - https://raw.githubusercontent.com/JoshuaMulliken/CVE-2019-8978/master/README.txt - https://ecommunities.ellucian.com/message/252749#252749 - https://ecommu
oshuaMulliken/CVE-2019-8978/master/README.txt - https://ecommunities.ellucian.com/message/252749#252749 - https://ecommunities.ellucian.com/message/252810#252810
CVE ID: CVE-2019-8979 State: PUBLISHED Published: 2019-02-21T05:00:00 Last Updated: 2024-08-04T21:31:37.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/huzr2018/orderby_SQLi
CVE ID: CVE-2019-8980 State: PUBLISHED Published: 2019-02-21T05:00:00 Last Updated: 2024-08-04T21:31:37.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1935705.html - http://www.securityfocus.com/bid/107120 - https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1935698.html - https://usn.ubuntu.com/3930-1/ - https://usn.ubuntu.com/3931-1/ - https:/
nux-kernel%40vger.kernel.org/msg1935698.html - https://usn.ubuntu.com/3930-1/ - https://usn.ubuntu.com/3931-1/ - https://usn.ubuntu.com/3931-2/ - https://usn.ubuntu.com/3930-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html - https://support.f5.com/csp/article/K56480726 - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html
CVE ID: CVE-2019-8981 State: PUBLISHED Published: 2019-03-26T01:21:21 Last Updated: 2024-08-04T21:31:37.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged. Additional Analyst Notes: - CVE Program Container: References: - http://axtls.sourceforge.net - https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842 - https://www.telekom.com/resource/blob/566546/276aaa2eab781729f2544d62edecf002/dl-190322-remote-buffer-overflow-in-a-axtls-data.pdf
CVE ID: CVE-2019-8982 State: PUBLISHED Published: 2019-02-21T14:00:00Z Last Updated: 2024-09-16T18:48:39.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45158
CVE ID: CVE-2019-8983 State: PUBLISHED Published: 2019-02-21T15:00:00Z Last Updated: 2024-09-17T00:36:36.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
CVE ID: CVE-2019-8984 State: PUBLISHED Published: 2019-02-21T15:00:00Z Last Updated: 2024-09-16T19:20:39.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN/
CVE ID: CVE-2019-8985 State: PUBLISHED Published: 2019-02-21T19:00:00 Last Updated: 2024-08-04T21:31:37.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP "Authorization: Basic" header that is mishandled by user_auth->user_ok in /bin/boa. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/mas
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WhooAmii/whooamii.github.io/blob/master/2018/netis/buffer%20overflow.md
CVE ID: CVE-2019-8986 State: PUBLISHED Published: 2019-03-07T22:00:00Z Last Updated: 2024-09-17T03:37:40.244Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server for ActiveMatrix BPM Problem Types: foo Description: The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4;
ing system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986
CVE ID: CVE-2019-8987 State: PUBLISHED Published: 2019-03-26T17:54:12.271402Z Last Updated: 2024-09-16T16:22:55.424Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: TIBCO Software Inc. Products: TIBCO Data Science for AWS, TIBCO Spotfire Data Science Problem Types: The impact of these multiple vulnerabilities includes the theoretical possibility that a malicious actor could gain more privileged access to the web server component. Description: The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site scripting vulnerability that theoretically allows an authenticated use
ire Data Science contains a persistent cross-site scripting vulnerability that theoretically allows an authenticated user to gain access to all the capabilities of the web interface available to more privileged users. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8987 - http://www.securityfocus.com/bid/107595
CVE ID: CVE-2019-8988 State: PUBLISHED Published: 2019-03-26T17:54:12.315596Z Last Updated: 2024-09-17T00:26:21.220Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Data Science for AWS, TIBCO Spotfire Data Science Problem Types: The impact of this vulnerability includes the theoretical possibility that a malicious actor could modify or delete data on the system that they should not be able to change, affecting the output that others might see. Description: The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulner
re Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected system, in a way that may allow for data modifications and deletions that should be denied. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-sc
visories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8988 - http://www.securityfocus.com/bid/107593
CVE ID: CVE-2019-8989 State: PUBLISHED Published: 2019-03-26T17:54:12.353941Z Last Updated: 2024-09-17T01:21:17.066Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Data Science for AWS, TIBCO Spotfire Data Science Problem Types: The impact of this vulnerability includes the theoretical possibility that a user of the system could temporarily fool another user of the system into believing they were someone else. Description: The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to l
, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8989 - http://www.securityfocus.com/bid/107608
CVE ID: CVE-2019-8990 State: PUBLISHED Published: 2019-04-09T17:37:10.700287Z Last Updated: 2024-09-16T17:03:00.302Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO ActiveMatrix BusinessWorks Problem Types: The impact of this vulnerability includes the possibility of a malicious HTTP client successfully executing HTTP requests without authenticating. This possibility is restricted to circumstances where HTTP basic authentication is used in conjunction with an XML Authentication resource. Description: The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theor
e HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.
: versions up to and including 6.4.2. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-9-2019-tibco-activematrix-businessworks - http://www.securityfocus.com/bid/107840
CVE ID: CVE-2019-8991 State: PUBLISHED Published: 2019-04-24T20:20:12.373688Z Last Updated: 2024-09-16T18:39:49.437Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid Problem Types: The impact of these vulnerabilities includes the theoretical possibility that an unprivileged remote attacker could gain full access to all the capabilities of the
the theoretical possibility that an unprivileged remote attacker could gain full access to all the capabilities of the web interface of the TIBCO ActiveMatrix Administrator. Description: The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains multiple vulnerabilities that may allow for cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. Affected releases are TIBCO So