Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10687 State: PUBLISHED Published: 2019-08-21T19:19:18 Last Updated: 2024-08-04T22:32:00.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pandujar/advisories/blob/master/KBPublisher_6.0.2.1_en.txt - http://packetstormsecurity.com/files/154184/KBPublisher-6.0.2.1-SQL-Injection.html
CVE ID: CVE-2019-10688 State: PUBLISHED Published: 2019-04-23T20:58:29 Last Updated: 2024-08-04T22:32:01.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device. Additional Analyst Notes: - CVE Program Container: References: - https://support.polycom.com/content/dam/polycom-support/global/documentation/hard-coded-credentials-vulnerability-in-vvx-products.pdf
CVE ID: CVE-2019-10689 State: PUBLISHED Published: 2019-06-24T21:10:20 Last Updated: 2024-08-04T22:32:01.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides insufficient authentication between the BToE application and the BToE component, resulting in leakage of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108799 - https://support.polycom.com/content/dam/polycom-support/global/documentation/insufficient-authentication-leakage-vvx-products.pdf
CVE ID: CVE-2019-10691 State: PUBLISHED Published: 2019-04-24T16:49:37 Last Updated: 2024-08-04T22:32:01.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/04/18/3 - https://dovecot.org/list/dovecot-news/2019-April/000406.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00000.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec
ity-announce/2019-05/msg00000.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/ - https://security.gentoo.org/glsa/201908-29
CVE ID: CVE-2019-10692 State: PUBLISHED Published: 2019-04-02T17:37:16 Last Updated: 2024-08-04T22:32:01.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755 - https://wordpress.org/plugins/wp-google-maps/#developers - http://www.rapid7.com/db/modules/auxiliary/admin/http/wp_google_maps_sqli - http://packetsto
p-google-maps/#developers - http://www.rapid7.com/db/modules/auxiliary/admin/http/wp_google_maps_sqli - http://packetstormsecurity.com/files/159640/WordPress-Rest-Google-Maps-SQL-Injection.html
CVE ID: CVE-2019-10694 State: PUBLISHED Published: 2019-12-11T23:02:26 Last Updated: 2024-08-04T22:32:00.632Z Vendors: n/a Products: Puppet Enterprise Problem Types: Credentials Management Description: The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2019-10694
CVE ID: CVE-2019-10695 State: PUBLISHED Published: 2019-12-11T23:04:57 Last Updated: 2024-08-04T22:32:01.196Z Vendors: n/a Products: Continuous Delivery for Puppet Enterprise (CD4PE) Problem Types: Insufficiently Protected Credentials Description: When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2019-10695
CVE ID: CVE-2019-10705 State: PUBLISHED Published: 2020-03-10T14:47:22 Last Updated: 2024-08-04T22:32:01.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted without knowledge of proper authentication credentials. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/cat_products.aspx?ID=6&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd - https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssd
CVE ID: CVE-2019-10706 State: PUBLISHED Published: 2020-03-10T12:45:10 Last Updated: 2024-08-04T22:32:01.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used to validate this digest is present in a protected area of the device, and if extracted could be used to install arbitrary firmware to other devices. Additional Analyst Notes: - CVE Program Container: References: - https://support.wdc.com/cat_products.aspx?ID=6&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd - https://www.
spx?ID=6&lang=en - https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd - https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-ssd
CVE ID: CVE-2019-10707 State: PUBLISHED Published: 2019-04-02T18:51:16 Last Updated: 2024-08-04T22:32:00.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: MKCMS V5.0 has SQL injection via the bplay.php play parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/181/
CVE ID: CVE-2019-10708 State: PUBLISHED Published: 2019-04-02T18:51:31 Last Updated: 2024-08-04T22:32:01.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/185/
CVE ID: CVE-2019-10709 State: PUBLISHED Published: 2019-09-04T11:14:39 Last Updated: 2024-08-04T22:32:01.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially privilege escalation via a crafted DeviceIoControl call. Additional Analyst Notes: - CVE Program Container: References: - https://blog.telspace.co.za/2019/08/tsa-2019-001-asus-precision-touchpad.html - http://packetstormsecurity.com/files/154259/Asus-Precision-TouchPad-11.0.0.25-Denial-Of-Service-Privilege-Escalation.html
CVE ID: CVE-2019-10710 State: PUBLISHED Published: 2019-04-23T19:06:47 Last Updated: 2024-08-04T22:32:01.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc. Additional Analyst Notes: - CVE Program Container: References: - https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/
CVE ID: CVE-2019-10711 State: PUBLISHED Published: 2019-04-23T19:21:41 Last Updated: 2024-08-04T22:32:01.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.1) allows attackers to view an RTSP stream by connecting to the stream with hidden credentials (guest or user) that are neither displayed nor configurable in the camera's CamHi or keye mobile management application. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc. Additional Analyst Notes: - CVE Prog
LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc. Additional Analyst Notes: - CVE Program Container: References: - https://dojo.bullguard.com/dojo-by-bullguard/blog/cam-hi-risk/
CVE ID: CVE-2019-10712 State: PUBLISHED Published: 2019-05-07T21:20:03 Last Updated: 2024-08-04T22:32:01.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/de-de/advisories/vde-2019-008 - http://www.securityfocus.com/bid/108482 - https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3
sts.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r38
ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2019-10714 State: PUBLISHED Published: 2019-04-02T20:16:04 Last Updated: 2024-08-04T22:32:01.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/58d9c46929ca0828edde34d263700c3a5fe8dc3c - https://github.com/ImageMagick/ImageMagick/commit/edc7d3035883ddca8413e4fe7689aa2e579ef04a - https://github.com/ImageMagick/ImageMagick/commit/07eebcd72f45c8fd7563d3f9ec5d2bed48f65f36 - https://github.com/ImageMagick/ImageMagick/issues/1495
CVE ID: CVE-2019-10715 State: PUBLISHED Published: 2019-10-20T23:44:35 Last Updated: 2024-08-04T22:32:01.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages. Additional Analyst Notes: - CVE Program Container: References: - https://www.verodin.com/technology/platform - http://www.nolanbkennedy.com/post/cve-2019-10715-stored-xss-verodin-director
CVE ID: CVE-2019-10716 State: PUBLISHED Published: 2019-10-20T23:47:26 Last Updated: 2024-08-04T22:32:01.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request. Additional Analyst Notes: - CVE Program Container: References: - https://www.verodin.com/ - https://www.verodin.com/technology/platform - http://www.nolanbkennedy.com/post/cve-2019-10716-information-disclosure-verodin-director - http://packetstormsecurity.com/files/156214/Verodin-Director-Web-Console-3.5.4.0-Password-Disclosure.html
CVE ID: CVE-2019-10717 State: PUBLISHED Published: 2019-07-03T15:40:20 Last Updated: 2024-08-04T22:32:00.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rxtur/BlogEngine.NET/commits/master - http://seclists.org/fulldisclosure/2019/Jun/44 - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect
CVE ID: CVE-2019-10718 State: PUBLISHED Published: 2019-06-21T18:23:15 Last Updated: 2024-08-04T22:32:01.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/153364/BlogEngine.NET-3.3.6-3.3.7-XML-Injection.html - https://www.securitymetrics.com/blog/blogenginenet-xml-external-entity-attacks
CVE ID: CVE-2019-10719 State: PUBLISHED Published: 2019-06-21T18:11:57 Last Updated: 2024-08-04T22:32:00.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jun/26 - http://packetstormsecurity.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html - https://www.secur
y.com/files/153347/BlogEngine.NET-3.3.6-3.3.7-dirPath-Directory-Traversal-Remote-Code-Execution.html - https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
CVE ID: CVE-2019-10720 State: PUBLISHED Published: 2019-06-21T18:13:16 Last Updated: 2024-08-04T22:32:01.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jun/26 - http://packetstormsecurity.com/files/153348/BlogEngine.NET-3.3.6-3.3.7-Theme-Cookie-Directory-Traversal-Remote-Code-Execution.html - https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code
raversal-Remote-Code-Execution.html - https://www.securitymetrics.com/blog/BlogEngineNET-Directory-Traversal-Remote-Code-Execution-CVE-2019-10719-CVE-2019-10720
CVE ID: CVE-2019-10721 State: PUBLISHED Published: 2019-07-03T15:23:03 Last Updated: 2024-08-04T22:32:01.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rxtur/BlogEngine.NET/commits/master - https://www.securitymetrics.com/blog/Blogenginenet-Directory-Traversal-Listing-Login-Page-Unvalidated-Redirect
CVE ID: CVE-2019-10723 State: PUBLISHED Published: 2019-04-03T17:01:04 Last Updated: 2024-08-04T22:32:01.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/podofo/tickets/46/
CVE ID: CVE-2019-10724 State: PUBLISHED Published: 2019-08-28T23:01:17 Last Updated: 2024-08-04T22:32:01.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege. The following are affected products and versions: Legion Y520T_Z370 6.0.1.8642, AIO310-20IAP 6.0.1.8642, AIO510-22ISH 6.0.1.8642, AIO510-23ISH 6.0.1.8642, AIO520-22IKL 6.0.1.8642, AIO520-22IKU 6.0.1.8642, AIO520-24IKL 6.0.1.8642, AIO520-24IKU 6.0.1.8642, AIO520-27IKL 6.0.1.8642, AIO720-24IKB 6.0.1.8642, IdeaCentre 520S-23IKU 6.0.1.8642, ThinkCentre M700z 6.0.
U 6.0.1.8642, AIO520-27IKL 6.0.1.8642, AIO720-24IKB 6.0.1.8642, IdeaCentre 520S-23IKU 6.0.1.8642, ThinkCentre M700z 6.0.1.8642, ThinkCentre M800z 6.0.1.8642, ThinkCentre M810z 6.0.1.8642, ThinkCentre M818z 6.0.1.8642, ThinkCentre M900Z 6.0.1.8642, ThinkCentre M910z 6.0.1.8642, V410z(YT S4250) 6.0.1.8642, 330-14IKBR Win10:6.0.1.8652, 330-15IKBR Win10:6.0.1.8652, 330-15IKBR (Brazil) Win10:6.0.1.8652, 330-15IKBR Touch Win10:6.0.1.8652, 330-17IKBR Win10:6.0.1.8652, YOGA 730-13IKB Win10:6.0.1.8644, YOGA 730-15IKB Win10:6.0.1.8644, ThinkPad L560 6.0.1.8644 and 6.0.1.8652, ThinkPad L570 6.0.1.8644 and 6.0.1.8652, ThinkPad P50 6.0.1.8642, ThinkPad P50s 6.0.1.8642, ThinkPad P51s (20Jx, 20Kx) 6.0.1.86
d L570 6.0.1.8644 and 6.0.1.8652, ThinkPad P50 6.0.1.8642, ThinkPad P50s 6.0.1.8642, ThinkPad P51s (20Jx, 20Kx) 6.0.1.8642, ThinkPad P51s (20Hx) 6.0.1.8642, ThinkPad P52s 6.0.1.8642, ThinkPad P70 6.0.1.8642, ThinkPad T25 6.0.1.8642, ThinkPad T460s 6.0.1.8642, ThinkPad T470 6.0.1.8642, ThinkPad T470s 6.0.1.8642, ThinkPad T480 6.0.1.8642, ThinkPad T480s 6.0.1.8642, ThinkPad T560 6.0.1.8642, ThinkPad T570 6.0.1.8642, ThinkPad T580 6.0.1.8642, ThinkPad X1 Carbon 8.66.76.72 and 8.66.68.54, ThinkPad X1 Carbon 6th 6.0.1.8642, ThinkPad X1 Carbon, X1 Yoga 8.66.62.92 and 8.66.62.54, ThinkPad X1 Tablet (20Gx) 6.0.1.8642, ThinkPad X1 Tablet (20Jx) 6.0.1.8642, ThinkPad X1 Tablet Gen 3 6.0.1.8642, ThinkPa
ThinkPad X1 Tablet (20Gx) 6.0.1.8642, ThinkPad X1 Tablet (20Jx) 6.0.1.8642, ThinkPad X1 Tablet Gen 3 6.0.1.8642, ThinkPad X1 Yoga (20Jx) 8.66.88.60, ThinkPad X1 Yoga 3rd 6.0.1.8642, ThinkPad X280 6.0.1.8642, ThinkPad Yoga 260, S1 8.66.62.92 and 8.66.62.54. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-26251 - https://lenovomobilesupport.lenovo.com/us/en/product_security/home
CVE ID: CVE-2019-10732 State: PUBLISHED Published: 2019-04-07T14:32:10 Last Updated: 2024-08-04T22:32:01.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - htt
the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.kde.org/show_bug.cgi?id=404698 - https://lists.debian.org/debian-lts-announce/2019/06/msg00012.html
CVE ID: CVE-2019-10734 State: PUBLISHED Published: 2019-04-07T14:34:33 Last Updated: 2024-08-04T22:32:01.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - htt
the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.kde.org/show_bug.cgi?id=404697
CVE ID: CVE-2019-10735 State: PUBLISHED Published: 2019-04-07T14:35:32 Last Updated: 2024-08-04T22:32:01.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - h
f the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4159
CVE ID: CVE-2019-10740 State: PUBLISHED Published: 2019-04-07T14:36:23 Last Updated: 2024-08-04T22:32:01.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: R
he plaintext of the encrypted message part(s) back to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/roundcube/roundcubemail/issues/6638 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/ - https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html
CVE ID: CVE-2019-10741 State: PUBLISHED Published: 2019-04-07T14:37:51 Last Updated: 2024-08-04T22:32:01.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states "We don't plan to take any action because of this." Additional Analyst Notes: - CVE Program Container: R
e vendor states "We don't plan to take any action because of this." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k9mail/k-9/issues/3925