Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-19222 State: PUBLISHED Published: 2020-03-04T18:03:51 Last Updated: 2024-08-05T02:09:39.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code into the info.html administration page by sending a crafted Forms/wireless_autonetwork_1 POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities -
-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19222.md
CVE ID: CVE-2019-19223 State: PUBLISHED Published: 2020-03-04T18:04:51 Last Updated: 2024-08-05T02:09:39.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0
ww.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19223.md
CVE ID: CVE-2019-19224 State: PUBLISHED Published: 2020-03-04T18:05:56 Last Updated: 2024-08-05T02:09:39.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file) settings by submitting a rom-0 GET request without being authenticated on the admin interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilit
ent_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19224.md
CVE ID: CVE-2019-19225 State: PUBLISHED Published: 2020-03-04T18:07:23 Last Updated: 2024-08-05T02:09:39.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://gi
https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19225.md
CVE ID: CVE-2019-19226 State: PUBLISHED Published: 2020-03-04T18:08:25 Last Updated: 2024-08-05T02:09:39.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter_1 POST request without being authenticated on the admin interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multip
order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities - https://github.com/0x8b30cc/DSL-2680-Multiple-Vulnerabilities/blob/master/CVE-2019-19226.md
CVE ID: CVE-2019-19227 State: PUBLISHED Published: 2019-11-22T13:39:40 Last Updated: 2024-08-05T02:09:39.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9804501fa1228048857910a6bf23e085aade37cc - https://cdn.kernel.org/pub/linux/kernel/v5.x
it/torvalds/linux.git/commit/?id=9804501fa1228048857910a6bf23e085aade37cc - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://seclists.org/bugtraq/2020/Jan/10 - http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://usn.ubuntu.com/4254-1/ - https://usn.ubuntu.com/4254-2/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://lists.debian.org/debian-lts-annou
om/4258-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
CVE ID: CVE-2019-19228 State: PUBLISHED Published: 2019-12-04T18:52:09 Last Updated: 2024-08-05T02:09:39.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Dec/5 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/ - http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Trave
019-19228/ - http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
CVE ID: CVE-2019-19229 State: PUBLISHED Published: 2019-12-04T18:50:17 Last Updated: 2024-08-05T02:09:39.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Dec/5 - https://sec-consult.com/en/blog/advisories/multiple-vulnerabilites-in-fronius-solar-inverter-series-cve-2019-19229-cve-2019-19228/ - http://packetstormsecurity.com/files/155562/Fronius-Solar-Inverter-Series-Insecure-Communication-Path-Traversal.html
CVE ID: CVE-2019-19230 State: PUBLISHED Published: 2019-12-09T20:36:49.352965Z Last Updated: 2024-09-17T02:16:04.832Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CA Technologies, A Broadcom Company Products: CA Release Automation Problem Types: CWE-502 Description: An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca20191209-01-security-notice-for-ca-nolio-release-automation.htm
s/product-content/recommended-reading/security-notices/ca20191209-01-security-notice-for-ca-nolio-release-automation.html?r=2 - http://seclists.org/fulldisclosure/2019/Dec/16 - https://seclists.org/bugtraq/2019/Dec/16 - http://packetstormsecurity.com/files/155631/CA-Nolio-6.6-Arbitrary-Code-Execution.html
CVE ID: CVE-2019-19231 State: PUBLISHED Published: 2019-12-20T21:08:06 Last Updated: 2024-08-05T02:09:39.417Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: CA Technologies, Broadcom Company Products: CA Client Automation Problem Types: CWE-65 Description: An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/CA20191218-01-security-notice-for-ca-client-automation-agent-for-windows.html - htt
recommended-reading/security-notices/CA20191218-01-security-notice-for-ca-client-automation-agent-for-windows.html - https://seclists.org/bugtraq/2019/Dec/41 - http://packetstormsecurity.com/files/155758/CA-Client-Automation-14.x-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2020/Jan/5
CVE ID: CVE-2019-19232 State: PUBLISHED Published: 2019-12-19T20:37:09 Last Updated: 2024-08-05T02:09:39.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this d
users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions Additional Analyst Notes: - CVE Program Container: References: - https://www.sudo.ws/stable.html - https://www.sudo.ws/devel.html#1.8.30b2 - https://security.netapp.com/advisory/ntap-20200103-0004/ - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979 - https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html - https://support2.windriver.com/index.php?page=defects&on=
ocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html - https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103 - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232 - https://access.redhat.com/security/cve/cve-2019-19232 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/ - https://support.apple.com/k
/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/ - https://support.apple.com/kb/HT211100 - http://seclists.org/fulldisclosure/2020/Mar/31 - https://support.apple.com/en-gb/HT211100 - https://www.tenable.com/plugins/nessus/133936 - https://www.oracle.com/security-alerts/bulletinapr2020.html
CVE ID: CVE-2019-19234 State: PUBLISHED Published: 2019-12-19T20:35:02 Last Updated: 2024-08-05T02:09:39.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shado
access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash Additional Analyst Notes: - CVE Program Container: References: - https://www.sudo.ws/stable.html - https://www.sudo.ws/devel.html#1.8.30b2 - https://security.neta
ntainer: References: - https://www.sudo.ws/stable.html - https://www.sudo.ws/devel.html#1.8.30b2 - https://security.netapp.com/advisory/ntap-20200103-0004/ - https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5505 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58104 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58473 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58772 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs60748 - https://www.tenable.com/plugins/nessus/132985 - https://support2.windriv
.cloudapps.cisco.com/quickview/bug/CSCvs60748 - https://www.tenable.com/plugins/nessus/132985 - https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1019-3816 - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19234 - https://www.suse.com/security/cve/CVE-2019-19234/ - https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html - https://access.redhat.com/security/cve/cve-2019-19234 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJN
5WVUC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/ - https://www.oracle.com/security-alerts/bulletinapr2020.html
CVE ID: CVE-2019-19235 State: PUBLISHED Published: 2019-12-18T13:06:59 Last Updated: 2024-08-05T02:09:39.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user must put an application at a particular path, with a particular file name. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/blog - https://www.asus.com/support/faq/1041545 - https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/
CVE ID: CVE-2019-19240 State: PUBLISHED Published: 2019-11-22T18:46:04 Last Updated: 2024-08-05T02:09:39.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/embedthis/goahead/issues/290 - https://github.com/embedthis/goahead/issues/289 - https://github.com/embedthis/goahead/release
this/goahead/issues/290 - https://github.com/embedthis/goahead/issues/289 - https://github.com/embedthis/goahead/releases/tag/v5.0.1
CVE ID: CVE-2019-19241 State: PUBLISHED Published: 2019-12-17T19:02:37 Last Updated: 2024-08-05T02:09:39.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context. Additional Anal
n unprivileged user, are sometimes performed by a kernel worker thread without considering that context. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.2 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1975 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=181e448d8709e517c9c7b523fcd209f24eb38ca7 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d69e07793f891524c6bbf1e75b9ae69db4450953 - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-19242 State: PUBLISHED Published: 2019-11-25T15:30:11 Last Updated: 2024-08-05T02:09:39.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sqlite/sqlite/commit/57f7ece78410a8aae86aa4625fb7556897db384c - https://usn.ubuntu.com/4205-1/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2019-19244 State: PUBLISHED Published: 2019-11-25T19:32:38 Last Updated: 2024-08-05T02:09:39.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348 - https://usn.ubuntu.com/4205-1/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2019-19245 State: PUBLISHED Published: 2019-12-02T13:54:09.000Z Last Updated: 2025-02-02T10:02:29.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org - https://packetstormsecurity.com/files/155505/Xinet-Elegant-6-Asset-Library-Web-Interface-6.1.655-SQL-Injection.html
CVE ID: CVE-2019-19246 State: PUBLISHED Published: 2019-11-25T16:16:20 Last Updated: 2024-08-05T02:09:39.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kkos/oniguruma/commit/d3e402928b6eb3327f8f7d59a9edfa622fec557b - https://bugs.php.net/bug.php?id=78559 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html - ht
.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html - https://usn.ubuntu.com/4460-1/
CVE ID: CVE-2019-19247 State: PUBLISHED Published: 2019-12-12T13:51:03 Last Updated: 2024-08-05T02:09:39.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client
CVE ID: CVE-2019-19248 State: PUBLISHED Published: 2019-12-12T13:52:23 Last Updated: 2024-08-05T02:09:39.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: References: - https://www.ea.com/security/news/easec-2019-001-elevation-of-privilege-vulnerability-in-origin-client
CVE ID: CVE-2019-19249 State: PUBLISHED Published: 2019-11-25T16:47:35 Last Updated: 2024-08-05T02:09:39.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4software/QueryTree/commit/57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f - https://github.com/d4software/QueryTree/compare/3.0.97-beta...3.0.99-beta
CVE ID: CVE-2019-19250 State: PUBLISHED Published: 2019-11-25T16:47:20 Last Updated: 2024-08-05T02:09:39.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/3s3s/opentrade/commit/a3eb3c645cfd1f3d310c10e4fb1f2f64a4d5e45e
CVE ID: CVE-2019-19251 State: PUBLISHED Published: 2019-12-10T14:26:52 Last Updated: 2024-08-05T02:09:39.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is an Enable SSL option, it is disabled by default, and cleartext requests are made as soon as the app starts. Additional Analyst Notes: - CVE Program Container: References: - https://getsatisfaction.com/lastfm/topics/why-doesnt-the-macos-client-enable-ssl-by-default-c1nh5k1s054ak
CVE ID: CVE-2019-19252 State: PUBLISHED Published: 2019-11-25T17:26:49 Last Updated: 2024-08-05T02:09:39.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb%40suse.com/ - https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-testing&id=0c9acb1af77a3cb8707e43f45b72c95266903cee - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.
903cee - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4258-1/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-19254 State: PUBLISHED Published: 2020-01-03T15:51:57 Last Updated: 2024-08-05T02:09:39.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://gitlab.com/gitlab-org/gitlab/issues/12219 - https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/