Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-7359 State: PUBLISHED Published: 2019-04-09T19:22:56 Last Updated: 2024-08-04T20:46:46.278Z Vendors: Autodesk Products: Autodesk Advance Steel, Autodesk AutoCAD, Autodesk AutoCAD Architecture, Autodesk AutoCAD Electrical, Autodesk AutoCAD Map 3D, Autodesk AutoCAD Mechanical, Autodesk AutoCAD MEP, Autodesk AutoCAD P&ID, Autodesk AutoCAD Plant 3D, Autodesk AutoCAD LT, Autodesk Civil 3D Problem Types: Use After Free Description: An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mech
utodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file with too many cell margins populating an AcCellMargin object may cause a heap overflow, resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0001
CVE ID: CVE-2019-7360 State: PUBLISHED Published: 2019-04-09T19:21:46 Last Updated: 2024-08-04T20:46:46.198Z Vendors: Autodesk Products: Autodesk Civil 3D, Autodesk Advance Steel, Autodesk AutoCAD, Autodesk AutoCAD Architecture, Autodesk AutoCAD Electrical, Autodesk AutoCAD Map 3D, Autodesk AutoCAD Mechanical, Autodesk AutoCAD MEP, Autodesk AutoCAD P&ID, Autodesk AutoCAD Plant 3D, Autodesk AutoCAD LT Problem Types: Heap Overflow Description: An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mecha
todesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may trigger a use-after-free, resulting in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0001
CVE ID: CVE-2019-7361 State: PUBLISHED Published: 2019-04-09T19:22:15 Last Updated: 2024-08-04T20:46:46.387Z Vendors: Autodesk Products: Autodesk Civil 3D, Autodesk Advance Steel, Autodesk AutoCAD, Autodesk AutoCAD Architecture, Autodesk AutoCAD Electrical, Autodesk AutoCAD Map 3D, Autodesk AutoCAD Mechanical, Autodesk AutoCAD MEP, Autodesk AutoCAD P&ID, Autodesk AutoCAD Plant 3D, Autodesk AutoCAD LT Problem Types: Deserialization of Untrusted Data Description: An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Au
y trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0001
CVE ID: CVE-2019-7362 State: PUBLISHED Published: 2019-08-23T19:35:31 Last Updated: 2024-08-04T20:46:46.181Z Vendors: n/a Products: Autodesk Design Review Problem Types: DLL preloading vulnerability Description: DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE ID: CVE-2019-7363 State: PUBLISHED Published: 2019-08-23T19:35:52 Last Updated: 2024-08-04T20:46:46.170Z Vendors: n/a Products: Autodesk Design Review Problem Types: Use-after-free vulnerability Description: Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a use-after-free vulnerability, which may result in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE ID: CVE-2019-7364 State: PUBLISHED Published: 2019-08-23T19:36:17 Last Updated: 2024-08-04T20:46:46.182Z Vendors: n/a Products: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD P&ID Problem Types: DLL preloading vulnerability Description: DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file t
MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0002
CVE ID: CVE-2019-7365 State: PUBLISHED Published: 2019-12-03T17:01:27 Last Updated: 2024-08-04T20:46:46.264Z Vendors: n/a Products: Autodesk Desktop Application Problem Types: DLL preloading vulnerability Description: DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file into the working directory, which may then leverage a DLL preloading vulnerability and execute code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0004
CVE ID: CVE-2019-7366 State: PUBLISHED Published: 2019-12-03T17:09:14 Last Updated: 2024-08-04T20:46:46.173Z Vendors: n/a Products: Autodesk FBX Software Development Kit Problem Types: Buffer overflow vulnerability Description: Buffer overflow vulnerability in Autodesk FBX Software Development Kit version 2019.5. A user may be tricked into opening a malicious FBX file which may exploit a buffer overflow vulnerability causing it to run arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2019-0003
CVE ID: CVE-2019-7383 State: PUBLISHED Published: 2019-03-17T19:04:54 Last Updated: 2024-08-04T20:46:46.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/isp_update_edit.php does not properly validate user input, which leads to shell command injection via the des parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151648/SYSTORME-ISG-Command-Injection.html - http://seclists.org/fulldisclosure/201
http://packetstormsecurity.com/files/151648/SYSTORME-ISG-Command-Injection.html - http://seclists.org/fulldisclosure/2019/Feb/32 - http://www.securityfocus.com/bid/107035 - https://s3curityb3ast.github.io/KSA-Dev-003.md - https://www.breakthesec.com/2019/02/cve-2019-7383-remote-code-execution-via.html
CVE ID: CVE-2019-7384 State: PUBLISHED Published: 2019-03-17T19:07:36 Last Updated: 2024-08-04T20:46:46.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation, this leads to authenticated code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151649/Raisecom-Technolog
nal Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151649/Raisecom-Technology-GPON-ONU-HT803G-07-Command-Injection.html - http://seclists.org/fulldisclosure/2019/Feb/33 - http://www.securityfocus.com/bid/107033 - https://s3curityb3ast.github.io/KSA-Dev-005.md - https://www.breakthesec.com/2019/02/cve-2019-7384-authenticated-remote-code.html
CVE ID: CVE-2019-7385 State: PUBLISHED Published: 2019-03-17T19:13:51 Last Updated: 2024-08-04T20:46:46.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107030 -
n the device. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107030 - http://packetstormsecurity.com/files/151650/Raisecom-Technology-GPON-ONU-HT803G-07-Command-Injection.html - http://seclists.org/fulldisclosure/2019/Feb/34 - http://breakthesec.com - http://www.breakthesec.com/search/label/0day - https://s3curityb3ast.github.io - https://s3curityb3ast.github.io/KSA-Dev-006.md
CVE ID: CVE-2019-7386 State: PUBLISHED Published: 2019-03-17T19:22:25 Last Updated: 2024-08-04T20:46:46.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Feb/35 - http://packetstormsecurity.com/files/151651/Nokia-8810-Denial-Of-Service.html - http://www.breakthese
sure/2019/Feb/35 - http://packetstormsecurity.com/files/151651/Nokia-8810-Denial-Of-Service.html - http://www.breakthesec.com/search/label/0day - https://s3curityb3ast.github.io - http://www.breakthesec.com - https://s3curityb3ast.github.io/KSA-Dev-007.md
CVE ID: CVE-2019-7387 State: PUBLISHED Published: 2019-02-04T22:00:00 Last Updated: 2024-08-04T20:46:46.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. When the export function is called from system/maintenance/export.php, it accepts the path provided by the user, leading to path traversal via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://s3curityb3ast.github.io/KSA-Dev-004.md - https://www.breakthesec.com/2019/02/cve-2019-7387-authenticated-arbitrary.html
CVE ID: CVE-2019-7388 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get sensitive information (such as MAC address) about all clients in the WLAN via the GetClientInfo HNAP API. Consequently, an attacker can achieve information disclosure without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonW7/D-Link/blob/master/Vul_3.md - http://www.securityfocus.com/bid/106852
CVE ID: CVE-2019-7389 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to reset the router without authentication via the SetFactoryDefault HNAP API. Consequently, an attacker can achieve a denial-of-service attack without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonW7/D-Link/blob/master/Vul_4.md - http://www.securityfocus.com/bid/106853
CVE ID: CVE-2019-7390 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack the DNS service configuration of all clients in the WLAN, without authentication, via the SetWanSettings HNAP API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonW7/D-Link/blob/master/Vul_5.md - http://www.securityfocus.com/bid/106855
CVE ID: CVE-2019-7391 State: PUBLISHED Published: 2019-03-17T19:33:52 Last Updated: 2024-08-04T20:46:46.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151550/Zyxel-VMG3312-B10B-DSL-491HNU-B1-V2-Cross-Site-Request-Forgery.html - https://www.exploit-db.com/exploits/46326/ - https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 - https://twitter.com/h1_yusuf
CVE ID: CVE-2019-7392 State: PUBLISHED Published: 2019-02-26T18:00:00 Last Updated: 2024-08-04T20:46:46.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107040 - https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190212-01--security-notice-for-ca-privileged-access-manager.html
CVE ID: CVE-2019-7393 State: PUBLISHED Published: 2019-05-28T18:28:30.990510Z Last Updated: 2024-09-16T19:19:28.204Z Vendors: CA Technologies, A Broadcom Company Products: CA Strong Authentication, CA Risk Authentication Problem Types: CWE-1021 Description: A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x may allow a remote attacker to gain sensitive information in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/66 - http://packetstormsecurity.com/files/153089/CA-Risk-Strong
ner: References: - https://seclists.org/bugtraq/2019/May/66 - http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html - http://www.securityfocus.com/bid/108483 - https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html - http://seclists.org/fulldisclosure/2019/May/43
CVE ID: CVE-2019-7394 State: PUBLISHED Published: 2019-05-28T18:25:49.842653Z Last Updated: 2024-09-17T01:16:51.683Z Vendors: CA Technologies, A Broadcom Company Products: CA Strong Authentication, CA Risk Authentication Problem Types: CWE-269 Description: A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/201
nd limited privileges. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/May/66 - http://packetstormsecurity.com/files/153089/CA-Risk-Strong-Authentication-Privilege-Escalation.html - http://www.securityfocus.com/bid/108483 - https://support.ca.com/us/product-content/recommended-reading/security-notices/CA20190523-01--security-notice-for-ca-risk-authentication-and-ca-strong-authentication.html - http://seclists.org/fulldisclosure/2019/May/43
CVE ID: CVE-2019-7395 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/8a43abefb38c5e29138e1c9c515b313363541c06 - https://github.com/ImageMagick/ImageMagick/issues/1451 - http://www.securityfocus.com/bid/106850 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ -
034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-7396 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1452 - http://www.securityfocus.com/bid/106849 - https://github.com/ImageMagick/ImageMagick/commit/748a03651e5b138bcaf160d15133de2f4b1b89ce - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-7397 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106847 - https://github.com/ImageMagick/ImageMagick/issues/1454 - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/11ad3aeb8ab1 - https://github.com/ImageMagick/ImageMagick/commit/306c1f0fa5754ca78efd16ab752f0e981d4f6b82 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http:
f0fa5754ca78efd16ab752f0e981d4f6b82 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-7398 State: PUBLISHED Published: 2019-02-05T00:00:00 Last Updated: 2024-08-04T20:46:46.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1453 - http://www.securityfocus.com/bid/106848 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-7399 State: PUBLISHED Published: 2019-02-17T04:00:00 Last Updated: 2024-08-04T20:46:46.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107025 - https://wwws.nightwatchcybersecurity.com/2019/02/07/content-injection-in-amazon-kindles-fireos-cve-2019-7399/
CVE ID: CVE-2019-7400 State: PUBLISHED Published: 2019-02-05T05:00:00 Last Updated: 2024-08-04T20:46:46.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rukovoditel before 2.4.1 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rukovoditel.net/rukovoditel-2-4-1/ - https://www.exploit-db.com/exploits/46608/ - http://packetstormsecurity.com/files/152248/Rukovoditel-ERP-And-CRM-2.4.1-Cross-Site-Scripting.html - https://hackpuntes.com/cve-2019-7400-rukovoditel-erp-crm-2-4-1-cross-site-scripting-reflejado/
CVE ID: CVE-2019-7401 State: PUBLISHED Published: 2019-02-08T03:00:00 Last Updated: 2024-08-04T20:46:46.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a denial of service (router process crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - http://unit.nginx.org/CHANGES.txt - http://mailman.nginx.org/pipermail/unit/2019-February/000113.html - http://hg.nginx.org/unit/file/tip/CHANGES - http://www.securityfocus.com/bid/106956
CVE ID: CVE-2019-7402 State: PUBLISHED Published: 2019-02-05T16:00:00Z Last Updated: 2024-09-16T23:10:23.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg&#95;qqcode parameter. This can be exploited via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/8
CVE ID: CVE-2019-7403 State: PUBLISHED Published: 2019-02-05T16:00:00Z Last Updated: 2024-09-17T00:36:33.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&tbname=../ URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/panghusec/exploit/issues/9
CVE ID: CVE-2019-7404 State: PUBLISHED Published: 2019-05-13T13:44:19 Last Updated: 2024-08-04T20:46:46.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today's_date}.log for reading a filename such as gapm7100_190101.log. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/epistemophilia/CVEs/blob/master/LG-GAMP-Routers/CVE-2019-7404/poc-cve-2019-7404.py
CVE ID: CVE-2019-7409 State: PUBLISHED Published: 2019-05-13T13:52:12 Last Updated: 2024-08-04T20:46:46.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page, (2) gbs, (3) side, (4) id, (5) imgid, (6) cat, or (7) orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://metamorfosec.com/Files/Advisories/METS-2019-001-Multiple_XSS_Vulnerabilities_in_ProfileDesign_CMS_v6.0.2.5.txt - https://www.vegadesign.net/?side=pdcmd_endringslogg