Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5605 State: PUBLISHED Published: 2019-07-26T00:09:11 Last Updated: 2024-08-04T20:01:51.696Z Vendors: FreeBSD Products: FreeBSD Problem Types: Kernel information exposure Description: In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient initialization of memory copied to userland in the freebsd32_ioctl interface, small amounts of kernel memory may be disclosed to userland processes. This may allow an attacker to leverage this information to obtain elevated privileges either directly or indirectly. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/ad
directly or indirectly. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:14.freebsd32.asc - http://packetstormsecurity.com/files/153749/FreeBSD-Security-Advisory-FreeBSD-SA-19-14.freebsd32.html - https://security.netapp.com/advisory/ntap-20190814-0003/
CVE ID: CVE-2019-5606 State: PUBLISHED Published: 2019-07-26T00:33:33 Last Updated: 2024-08-04T20:01:51.956Z Vendors: FreeBSD Products: FreeBSD Problem Types: Kernel use after free Description: In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, code which handles close of a descriptor created by posix_openpt fails to undo a signal configuration. This causes an incorrect signal to be raised leading to a write after free of kernel memory allowing a malicious user to gain root privileges or escape a jail. Additional Analyst Notes: - CVE Program Container: Reference
a malicious user to gain root privileges or escape a jail. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:13.pts.asc - http://packetstormsecurity.com/files/153748/FreeBSD-Security-Advisory-FreeBSD-SA-19-13.pts.html - https://security.netapp.com/advisory/ntap-20190814-0003/
CVE ID: CVE-2019-5607 State: PUBLISHED Published: 2019-07-26T00:28:44 Last Updated: 2024-08-04T20:01:51.838Z Vendors: FreeBSD Products: FreeBSD Problem Types: Improper update of reference count Description: In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, rights transmitted over a domain socket did not properly release a reference on transmission error allowing a malicious user to cause the reference counter to wrap, forcing a free event. This could allow a malicious local user to gain root privileges or escape from a jail. Additional Analyst Notes: - CVE Prog
s could allow a malicious local user to gain root privileges or escape from a jail. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:17.fd.asc - http://packetstormsecurity.com/files/153755/FreeBSD-Security-Advisory-FreeBSD-SA-19-17.fd.html - https://security.netapp.com/advisory/ntap-20190814-0003/
CVE ID: CVE-2019-5608 State: PUBLISHED Published: 2019-08-29T21:54:22 Last Updated: 2024-08-04T20:01:51.831Z Vendors: n/a Products: FreeBSD Problem Types: Out of bounds read Description: In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page and subsequently panic. Additional Analyst Notes: - CVE Program
y cause the kernel to attempt to access an unmapped page and subsequently panic. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:19.mldv2.asc - https://security.netapp.com/advisory/ntap-20190910-0002/
CVE ID: CVE-2019-5609 State: PUBLISHED Published: 2019-08-29T21:54:42 Last Updated: 2024-08-04T20:01:51.639Z Vendors: n/a Products: FreeBSD Problem Types: Improper input validation Description: In FreeBSD 12.0-STABLE before r350619, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350619, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the bhyve e1000 device emulation used a guest-provided value to determine the size of the on-stack buffer without validation when TCP segmentation offload is requested for a transmitted packet. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host. Additional Analyst Notes: - CVE Program Contai
ving bhyve guest could overwrite memory in the bhyve process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:21.bhyve.asc - https://security.netapp.com/advisory/ntap-20190910-0002/
CVE ID: CVE-2019-5610 State: PUBLISHED Published: 2019-08-29T21:37:28 Last Updated: 2024-08-04T20:01:51.676Z Vendors: n/a Products: FreeBSD Problem Types: Out of bounds read Description: In FreeBSD 12.0-STABLE before r350637, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350638, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE before 11.2-RELEASE-p13, the bsnmp library is not properly validating the submitted length from a type-length-value encoding. A remote user could cause an out-of-bounds read or trigger a crash of the software such as bsnmpd resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/adv
n a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:20.bsnmp.asc - https://seclists.org/bugtraq/2019/Aug/6 - http://packetstormsecurity.com/files/153959/FreeBSD-Security-Advisory-FreeBSD-SA-19-20.bsnmp.html - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:20.bsnmp.asc - https://security.netapp.com/advisory/ntap-20190910-0002/
CVE ID: CVE-2019-5611 State: PUBLISHED Published: 2019-08-29T21:37:31 Last Updated: 2024-08-04T20:01:51.948Z Vendors: n/a Products: FreeBSD Problem Types: Improper check for unusual conditions Description: In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, a missing check in the function to arrange data in a chain of mbufs could cause data returned not to be contiguous. Extra checks in the IPv6 stack could catch the error condition and trigger a kernel panic, leading to a remote denial of service. Additional Analyst Notes: - CVE Program Container: References: -
a kernel panic, leading to a remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.asc - https://seclists.org/bugtraq/2019/Aug/33 - http://packetstormsecurity.com/files/154170/FreeBSD-Security-Advisory-FreeBSD-SA-19-22.mbuf.html - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:22.mbuf.asc - https://security.netapp.com/advisory/ntap-20190910-0002/
CVE ID: CVE-2019-5612 State: PUBLISHED Published: 2019-08-29T22:31:46 Last Updated: 2024-08-04T20:01:51.526Z Vendors: n/a Products: FreeBSD Problem Types: Improper check for unusual conditions Description: In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD
ies of midistat's data buffer. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-19:23.midi.asc - https://security.netapp.com/advisory/ntap-20190910-0002/
CVE ID: CVE-2019-5613 State: PUBLISHED Published: 2020-02-18T15:26:45 Last Updated: 2024-08-04T20:01:51.762Z Vendors: n/a Products: FreeBSD Problem Types: Improper check for unusual conditions Description: In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec endpoint. Depending on the higher-level protocol in use over ipsec, this could allow an action to be repeated. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:02.ipsec.asc
CVE ID: CVE-2019-5614 State: PUBLISHED Published: 2020-04-28T23:41:40 Last Updated: 2024-08-04T20:01:51.555Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds read Description: In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in accessing out-of-bounds memory leading to a kernel panic or other unpredictable results. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:10.ipfw.asc - https://security.netapp.com/advisory/ntap-20200511-0002/
CVE ID: CVE-2019-5615 State: PUBLISHED Published: 2019-04-09T15:27:05.703271Z Last Updated: 2024-09-17T03:02:06.706Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Rapid7 Products: InsightVM Problem Types: CWE-257, Storing Passwords in a Recoverable Format Description: Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. Thi
and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/insightvm/en-us/release-notes/#6.5.50
CVE ID: CVE-2019-5616 State: PUBLISHED Published: 2019-03-15T21:00:00Z Last Updated: 2024-09-16T17:34:24.361Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/03/12/r7-2019-01-circuitwerkes-sicon-8-client-side-authentication-read-only-bypass-cve-2019-5616/
CVE ID: CVE-2019-5617 State: PUBLISHED Published: 2019-11-06T18:30:42.339821Z Last Updated: 2024-09-17T02:21:04.696Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Computing For Good Products: Basic Laboratory Information System Problem Types: CWE-284 Description: Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5
yst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/
CVE ID: CVE-2019-5618 State: PUBLISHED Published: 2020-04-29T22:15:27.082296Z Last Updated: 2024-09-16T16:53:06.600Z Vendors: A-PDF Products: WAV to MP3 Problem Types: CWE-121 Description: A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/windows/fileformat/a_pdf_wav_to_mp3
CVE ID: CVE-2019-5619 State: PUBLISHED Published: 2020-04-29T22:15:27.497274Z Last Updated: 2024-09-16T23:02:06.165Z Vendors: AASync.com Products: AASync Problem Types: CWE-121 Description: AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/windows/ftp/aasync_list_reply
CVE ID: CVE-2019-5620 State: PUBLISHED Published: 2020-04-29T22:15:27.966812Z Last Updated: 2024-09-17T03:28:34.323Z Vendors: ABB Products: MicroSCADA Pro SYS600 Problem Types: CWE-306 Description: ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/windows/scada/abb_wserver_exec
CVE ID: CVE-2019-5621 State: PUBLISHED Published: 2020-04-29T22:15:28.394809Z Last Updated: 2024-09-17T00:31:29.750Z Vendors: ABBS Software Products: Audio Media Player Problem Types: CWE-121 Description: ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/windows/fileformat/abbs_amp_lst
CVE ID: CVE-2019-5622 State: PUBLISHED Published: 2020-04-29T22:15:28.858702Z Last Updated: 2024-09-16T18:55:28.051Z Vendors: Accellion Products: File Transfer Appliance Problem Types: CWE-798 Description: Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2
CVE ID: CVE-2019-5623 State: PUBLISHED Published: 2020-04-29T22:15:29.271646Z Last Updated: 2024-09-16T20:48:06.058Z Vendors: Accellion Products: File Transfer Appliance Problem Types: CWE-77 Description: Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'). Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2
CVE ID: CVE-2019-5624 State: PUBLISHED Published: 2019-04-30T16:53:31.816001Z Last Updated: 2024-09-17T04:29:13.622Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Rapid7 Products: Metasploit Framework Problem Types: CWE-22 Description: Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions. Additional Anal
r running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/11716 - https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416 - https://blog.doyensec.com/2019/04/24/rubyzip-bug.html
CVE ID: CVE-2019-5625 State: PUBLISHED Published: 2019-05-22T18:11:12 Last Updated: 2024-08-04T20:01:52.038Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Eaton Products: HALO Home Problem Types: CWE-922 Description: The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by reusing the stored OAuth token, thus allowing them to view and change the user's personal information stored in the backend cloud service. The attacker wo
us allowing them to view and change the user's personal information stored in the backend cloud service. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/ - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/CVE-2019-5625-Halo-home-smart-lighting-vulnerability-advisory.pdf
CVE ID: CVE-2019-5626 State: PUBLISHED Published: 2019-05-22T18:11:32 Last Updated: 2024-08-04T20:01:51.895Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: BlueCats Products: Reveal Problem Types: CWE-922 Description: The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app. Additional Analys
would first need to gain physical control of the Android device or compromise it with a malicious app. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/ - https://play.google.com/store/apps/details?id=com.bluecats.bcreveal
CVE ID: CVE-2019-5627 State: PUBLISHED Published: 2019-05-22T18:12:01 Last Updated: 2024-08-04T20:01:52.006Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: BlueCats Products: Reveal Problem Types: CWE-922 Description: The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the iOS device or compromise it with a malicious app. Additional Analyst Notes: - CVE Program Containe
ysical control of the iOS device or compromise it with a malicious app. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/05/21/investigating-the-plumbing-of-the-iot-ecosystem-r7-2018-65-r7-2019-07-fixed/ - https://itunes.apple.com/us/app/bc-reveal/id852676494
CVE ID: CVE-2019-5629 State: PUBLISHED Published: 2019-07-13T00:15:43.850364Z Last Updated: 2024-09-16T22:45:30.681Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rapid7 Products: Insight Agent Problem Types: CWE-427 Description: Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Agent 2.6.3 and prior starts, the Python interpreter attempts to load python3.dll at "C:\DLLs\python3.dll," which normally is writable by locally authenticated users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privile
users. Because of this, a malicious local user could use Insight Agent's startup conditions to elevate to SYSTEM privileges. This issue was fixed in Rapid7 Insight Agent 2.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Jun/0 - http://packetstormsecurity.com/files/153159/Rapid7-Windows-InsightIDR-Agent-2.6.3.14-Local-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2019/Jun/13 - https://help.rapid7.com/insightagent/release-notes/archive/2019/05/#20190529 - https://bogner.sh/2019/06/local-privilege-escalation-in-rapid7s-windows-insight-idr-agent/
CVE ID: CVE-2019-5630 State: PUBLISHED Published: 2019-07-03T17:00:55 Last Updated: 2024-08-04T20:01:51.880Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Rapid7 Products: Nexpose/InsightVM Security Console Problem Types: Cross-Site Request Forgery Description: A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-flight OPTIONS request. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/nexpose/en-us/release-notes#6.5
Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/nexpose/en-us/release-notes#6.5.69
CVE ID: CVE-2019-5631 State: PUBLISHED Published: 2019-08-19T14:32:40.201322Z Last Updated: 2024-09-16T21:03:32.967Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rapid7 Products: InsightAppSec Problem Types: CWE-427 Description: The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product. Additional Analyst Notes: -
(usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product. Additional Analyst Notes: - CVE Program Container: References: - https://help.rapid7.com/insightappsec/release-notes/archive/2019/07/
CVE ID: CVE-2019-5632 State: PUBLISHED Published: 2019-08-22T13:51:36.900485Z Last Updated: 2024-09-16T21:57:21.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Belwith Products, LLC Products: Hickory Smart Problem Types: CWE-922 Description: An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://blog
roid, version 01.01.43 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/ - https://play.google.com/store/apps/details?id=com.belwith.hickorysmart&hl=en_US
CVE ID: CVE-2019-5633 State: PUBLISHED Published: 2019-08-22T13:51:36.974673Z Last Updated: 2024-09-16T16:42:37.789Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Belwith Products, LLC Products: Hickory Smart Problem Types: CWE-922 Description: An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for iOS, version 01.01.07 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.
rsion 01.01.07 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rapid7.com/2019/08/01/r7-2019-18-multiple-hickory-smart-lock-vulnerabilities/ - https://apps.apple.com/us/app/hickory-smart/id1189748191