Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-11416 State: PUBLISHED Published: 2019-04-21T19:38:47 Last Updated: 2024-08-04T22:55:40.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstrated by v1/system/user. Additional Analyst Notes: - CVE Program Container: References: - https://1.337.zone/2019/04/08/intelbras-iwr-3000n-1-5-0-csrf-lead-to-router-takeover/ - https://www.exploit-db.com/exploits/46770/ - http://packetstormsecurity.com/files/152682/Intelbras-IWR-3000N-1.5.0-Cross-Site-Request-Forgery.html
CVE ID: CVE-2019-11417 State: PUBLISHED Published: 2019-04-21T20:09:41 Last Updated: 2024-08-04T22:55:39.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: system.cgi on TRENDnet TV-IP110WN cameras has a buffer overflow caused by an inadequate source-length check before a strcpy operation in the respondAsp function. Attackers can exploit the vulnerability by using the languse parameter with a long string. This affects 1.2.2 build 28, 64, 65, and 68. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png
CVE ID: CVE-2019-11418 State: PUBLISHED Published: 2019-04-21T20:09:53 Last Updated: 2024-08-04T22:55:40.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: apply.cgi on the TRENDnet TEW-632BRP 1.010B32 router has a buffer overflow via long strings to the SOAPACTION:HNAP1 interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zyw-200/IOTFuzzer/blob/master/Trendnet_response.png
CVE ID: CVE-2019-11419 State: PUBLISHED Published: 2019-05-14T18:03:36 Last Updated: 2024-08-04T22:55:40.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone's IMEI. The crash occurs upon receiving a message that contains the replaced emoji. Additional Analyst Notes: - CVE Program Container: References: - https://awakened1712.github.io/hacking/hacking-wechat-dos/
tional Analyst Notes: - CVE Program Container: References: - https://awakened1712.github.io/hacking/hacking-wechat-dos/ - http://packetstormsecurity.com/files/152947/WeChat-7.0.4-Denial-Of-Service.html - https://www.exploit-db.com/exploits/46853
CVE ID: CVE-2019-11426 State: PUBLISHED Published: 2019-04-21T21:35:39 Last Updated: 2024-08-04T22:55:39.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/64
CVE ID: CVE-2019-11427 State: PUBLISHED Published: 2019-04-21T21:35:53 Last Updated: 2024-08-04T22:55:40.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/64
CVE ID: CVE-2019-11428 State: PUBLISHED Published: 2019-04-21T22:06:45 Last Updated: 2024-08-04T22:55:39.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian 4.10 has XSS via the export.php export_files parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/139
CVE ID: CVE-2019-11429 State: PUBLISHED Published: 2019-05-13T14:44:56 Last Updated: 2024-08-04T22:55:39.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen. Additional Analyst Notes: - CVE Program Container: References: - https://CentOS-WebPanel.com - https://www.exploit-db.com/exploits/46784/ - http://packetstormsecurity.com/files/152696/CentOS-Web-Panel-Domain-Field-Cross-Site-Scripting.html
CVE ID: CVE-2019-11444 State: PUBLISHED Published: 2019-04-22T04:00:36 Last Updated: 2024-08-04T22:55:39.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw Additional Anal
erability since it is a feature for administrators to run groovy scripts and therefore not a design flaw Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46525 - https://pentest.com.tr/exploits/Liferay-CE-Portal-Tomcat-7-1-2-ga3-Groovy-Console-Remote-Command-Execution-Metasploit.html - https://dev.liferay.com/discover/portal/-/knowledge_base/7-1/running-scripts-from-the-script-console
CVE ID: CVE-2019-11445 State: PUBLISHED Published: 2019-04-22T04:00:49 Last Updated: 2024-08-04T22:55:39.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result, attackers can gain remote code execution through the application server with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46526 - ht
vileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46526 - https://pentest.com.tr/exploits/OpenKM-DM-6-3-7-Remote-Command-Execution-Metasploit.html
CVE ID: CVE-2019-11446 State: PUBLISHED Published: 2019-04-22T04:01:09 Last Updated: 2024-08-04T22:55:39.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46691/ - http://pentest.com.tr/exploits/ATutor-2-2-4-file-manager-Remote-Cod
nces: - https://www.exploit-db.com/exploits/46691/ - http://pentest.com.tr/exploits/ATutor-2-2-4-file-manager-Remote-Code-Execution-Injection-Metasploit.html
CVE ID: CVE-2019-11447 State: PUBLISHED Published: 2019-04-22T04:01:27 Last Updated: 2024-08-04T22:55:39.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.) Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46698/ -
for this.) Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46698/ - http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html - http://packetstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.html
CVE ID: CVE-2019-11448 State: PUBLISHED Published: 2019-04-22T04:01:40 Last Updated: 2024-08-04T22:55:39.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTEM on the server due to a Popup_SLA.jsp sid SQL injection vulnerability. For example, the attacker can subsequently write arbitrary text to a .vbs file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46725/ - https://www.exploit-db.com/exploits/46725 - https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Executio
ww.exploit-db.com/exploits/46725 - https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-SQLi-Remote-Code-Execution.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11448.html
CVE ID: CVE-2019-11449 State: PUBLISHED Published: 2019-04-22T13:51:18 Last Updated: 2024-08-04T22:55:40.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: I, Librarian 4.10 has XSS via the notes.php notes parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mkucej/i-librarian/issues/140
CVE ID: CVE-2019-11450 State: PUBLISHED Published: 2019-04-22T14:12:47 Last Updated: 2024-08-04T22:55:40.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md
CVE ID: CVE-2019-11451 State: PUBLISHED Published: 2019-04-22T14:12:58 Last Updated: 2024-08-04T22:55:40.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: whatsns 4.0 allows index.php?inform/add.html qid SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md
CVE ID: CVE-2019-11452 State: PUBLISHED Published: 2019-04-22T14:13:09 Last Updated: 2024-08-04T22:55:40.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kikulo/DebugOpen/blob/master/whatsns4.0/Main.md
CVE ID: CVE-2019-11454 State: PUBLISHED Published: 2019-04-22T15:05:51 Last Updated: 2024-08-04T22:55:40.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/tildeslash/monit/commits/328f60773057641c4b2075fab9820145e95b728c - https://bitbucket.org/tildeslash/monit/commits/1a8295eab
eslash/monit/commits/328f60773057641c4b2075fab9820145e95b728c - https://bitbucket.org/tildeslash/monit/commits/1a8295eab6815072a18019b668fe084945b751f3 - https://github.com/dzflack/exploits/blob/master/unix/monit_xss.py - https://lists.debian.org/debian-lts-announce/2019/04/msg00028.html - https://usn.ubuntu.com/3971-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L475QJMFFI2QV5QEHAKKPVX6QX6ECUL6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZQDHRSKTEX5MSYXNCGFTUSFGANBARHX/ - https://lists.debian.org/debian-lts-announce/2021/12/msg00018.html
CVE ID: CVE-2019-11455 State: PUBLISHED Published: 2019-04-22T15:06:12 Last Updated: 2024-08-04T22:55:40.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage). Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/tildeslash/monit/commits/f12d0cdb42d4e74dffe1525d4062c815c48ac57a - https://github.com/dzflack/exploits/blob/master/unix/monit_buffer_overread.py - https://github.com
25d4062c815c48ac57a - https://github.com/dzflack/exploits/blob/master/unix/monit_buffer_overread.py - https://github.com/dzflack/exploits/blob/master/macos/monit_dos.py - https://lists.debian.org/debian-lts-announce/2019/04/msg00028.html - https://usn.ubuntu.com/3971-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L475QJMFFI2QV5QEHAKKPVX6QX6ECUL6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZQDHRSKTEX5MSYXNCGFTUSFGANBARHX/ - https://lists.debian.org/debian-lts-announce/2021/12/msg00018.html
CVE ID: CVE-2019-11456 State: PUBLISHED Published: 2019-04-22T15:33:49 Last Updated: 2024-08-04T22:55:40.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://cisk123456.blogspot.com/2019/04/gila-cms-1101-csrf.html
CVE ID: CVE-2019-11457 State: PUBLISHED Published: 2019-08-27T14:52:31 Last Updated: 2024-08-04T22:55:39.664Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/. Additional Analyst Notes: - CVE Program Container: References: - https://www.netsparker.com/blog/web-security/ - http://packetstormsecurity.com/files/154219/Django-CRM-0.2.1-Cross-Site-Request-Forgery.html - http
blog/web-security/ - http://packetstormsecurity.com/files/154219/Django-CRM-0.2.1-Cross-Site-Request-Forgery.html - http://seclists.org/fulldisclosure/2019/Aug/30
CVE ID: CVE-2019-11458 State: PUBLISHED Published: 2019-05-08T17:07:54 Last Updated: 2024-08-04T22:55:40.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cakephp/cakephp/releases - https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7 - https://github.com/cakephp/cakephp/commits/master - https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html - https://github.com/cakephp/cakephp/commit/1a74e798309192a989
akephp.org/2019/04/23/cakephp_377_3615_3518_released.html - https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e
CVE ID: CVE-2019-11459 State: PUBLISHED Published: 2019-04-22T20:26:32 Last Updated: 2024-08-04T22:55:40.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/evince/issues/1129 - https://usn.ubuntu.com/3959-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3N
/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html - https://access.redhat.com/errata/RHSA-2019:3553 - https://www.debian.org/security/2020/dsa-4624 - https://seclists.org/bugtraq/2020/Feb/18
CVE ID: CVE-2019-11460 State: PUBLISHED Published: 2019-04-22T20:26:42 Last Updated: 2024-08-04T22:55:40.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. Additional Analyst Notes:
s due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/gnome-desktop/issues/112 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5V6EIUHYR7SNKCRIGYCD3UWNEGFNT2F/ - https://usn.ubuntu.com/3994-1/ - https://security.gentoo.org/glsa/201908-28 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html
CVE ID: CVE-2019-11461 State: PUBLISHED Published: 2019-04-22T20:26:50 Last Updated: 2024-08-04T22:55:40.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. Additional Analyst Notes: - CVE Program Container:
g of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/nautilus/issues/987 - https://security.gentoo.org/glsa/201908-27 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html
CVE ID: CVE-2019-11463 State: PUBLISHED Published: 2019-04-23T02:05:47 Last Updated: 2024-08-04T22:55:40.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/issues/1165 - https://github.com/libarchive/libarchive/commit/ba641f73f3
ces: - https://github.com/libarchive/libarchive/issues/1165 - https://github.com/libarchive/libarchive/commit/ba641f73f3d758d9032b3f0e5597a9c6e593a505
CVE ID: CVE-2019-11464 State: PUBLISHED Published: 2019-09-10T16:38:19 Last Updated: 2024-08-04T22:55:40.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Serve
luded in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092). Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11465 State: PUBLISHED Published: 2019-09-10T16:55:49 Last Updated: 2024-08-04T22:55:39.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the usernames for all users currently logged into the system even if the log was redacted for privacy. This has been fixed (in 5.5.4 and 6.0.1) so that usernames are tagged properly in the logs and are hashed out when the logs are redacted. Additional Analyst Notes: - CVE Program Container: Referen
ly in the logs and are hashed out when the logs are redacted. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11466 State: PUBLISHED Published: 2019-09-10T17:02:30 Last Updated: 2024-08-04T22:55:40.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require credentials on a port earmarked for internal traffic only. This has been remedied in version 6.0.1 and now requires valid credentials to access. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11467 State: PUBLISHED Published: 2019-09-10T17:21:50 Last Updated: 2024-08-04T22:55:40.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index entries contain certain characters like \t, <, >, it caused buffer overrun as encoded string would be much larger than accounted for, causing indexer service to crash and restart. This has been remedied in versions 5.1.2 and 5.5.2 to ensure buffer always grows as needed for any input. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11469 State: PUBLISHED Published: 2019-04-23T03:12:55 Last Updated: 2024-08-04T22:55:40.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequently, an unauthenticated user can gain the authority of SYSTEM on the server by uploading a malicious file via the "Execute Program Action(s)" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46740/ - https://www.exploit-db.com/exploits/46740 - https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html - ht
loits/46740 - https://pentest.com.tr/exploits/ManageEngine-App-Manager-14-Auth-Bypass-Remote-Command-Execution.html - http://packetstormsecurity.com/files/152607/ManageEngine-Applications-Manager-14.0-SQL-Injection-Command-Injection.html - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-11469.html