Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16248 State: PUBLISHED Published: 2019-09-11T22:19:49 Last Updated: 2024-08-05T01:10:41.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message). Additional Analyst Notes: - CVE Program Container: References: - https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html - https://github
CVE Program Container: References: - https://www.inputzero.io/2019/09/telegram-privacy-fails-again.html - https://github.com/RootUp/PersonalStuff/blob/master/Telegram_Privacy.pdf - https://www.openwall.com/lists/oss-security/2019/09/09/2
CVE ID: CVE-2019-16249 State: PUBLISHED Published: 2019-09-11T22:19:33 Last Updated: 2024-08-05T01:10:41.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/issues/15481
CVE ID: CVE-2019-16250 State: PUBLISHED Published: 2019-09-11T22:55:49 Last Updated: 2024-08-05T01:10:41.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/settings-change-and-css-injection-in-wordpress-ocean-extra-plugin/
CVE ID: CVE-2019-16251 State: PUBLISHED Published: 2019-10-31T16:09:29 Last Updated: 2024-08-05T01:10:41.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9932 - https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework/
CVE ID: CVE-2019-16252 State: PUBLISHED Published: 2020-06-12T22:15:51 Last Updated: 2024-08-05T01:10:41.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data. Additional Analyst Notes: - CVE Program Container: References: - https://arxiv.org/pdf/2005.08208.pdf
CVE ID: CVE-2019-16253 State: PUBLISHED Published: 2019-09-25T22:40:55 Last Updated: 2024-08-05T01:10:41.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Text-to-speech Engine (aka SamsungTTS) application before 3.0.02.7 and 3.0.00.101 for Android allows a local attacker to escalate privileges, e.g., to system privileges. The Samsung case ID is 101755. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/154614/Samsung-Mobile-Android-SamsungTTS-Privilege-Escalation.html - https://github.com/flankerhqd/vendor-android-cves/tree/master/SMT-CVE-2019-16253 - https://blog.flanker017.me/text-to-speech-speaks-pwned/
CVE ID: CVE-2019-16254 State: PUBLISHED Published: 2019-11-26T00:00:00 Last Updated: 2024-08-05T01:10:41.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF. Additional Analyst Notes: - CVE Program Container: References: - https:/
d not address an isolated CR or an isolated LF. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/331984 - https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html - https://www.ruby-lang.org/ja/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/ - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/ - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/ - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html - https://seclists.org/bugtraq/2019/Dec/31 - https://seclists.org/bugtraq/2019/Dec/32 - https://www.debian.org
0009.html - https://seclists.org/bugtraq/2019/Dec/31 - https://seclists.org/bugtraq/2019/Dec/32 - https://www.debian.org/security/2019/dsa-4587 - https://www.debian.org/security/2019/dsa-4586 - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.gentoo.org/glsa/202003-06 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
CVE ID: CVE-2019-16255 State: PUBLISHED Published: 2019-11-26T00:00:00 Last Updated: 2024-08-05T01:10:41.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/327512 - https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/ - https://www.ruby-lang.org/ja
2019/11/msg00025.html - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/ - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/ - https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/ - https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/ - https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html - https://seclists.org/bugtraq/2019/Dec/31 - https://seclists.org/bugtraq/2019/Dec/32 - https://www.debian.org/security/2019/dsa-4587 - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.gentoo.org/glsa/202003-06 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html - h
ps://security.gentoo.org/glsa/202003-06 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
CVE ID: CVE-2019-16256 State: PUBLISHED Published: 2019-09-12T12:56:18.000Z Last Updated: 2025-10-21T23:45:30.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
CVE ID: CVE-2019-16257 State: PUBLISHED Published: 2019-09-12T12:56:03 Last Updated: 2024-08-05T01:10:41.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.adaptivemobile.com/blog/simjacker-next-generation-spying-over-mobile
CVE ID: CVE-2019-16258 State: PUBLISHED Published: 2020-03-20T17:08:15 Last Updated: 2024-08-05T01:10:41.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via the CLI after connecting to the internal UART interface. Additional Analyst Notes: - CVE Program Container: References: - https://store.hom.ee/collections/all/products/homee-brain-cube - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-026.txt
CVE ID: CVE-2019-16261 State: PUBLISHED Published: 2019-09-12T14:07:11.000Z Last Updated: 2025-03-21T13:56:28.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053. Additional Analyst Notes: - CVE Program Container: References: - https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_
otes: - CVE Program Container: References: - https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_bits - https://gist.github.com/Shlucus/ab762d6b148f2d2d046c956526a80ddc
CVE ID: CVE-2019-16263 State: PUBLISHED Published: 2019-10-07T11:19:26 Last Updated: 2024-08-05T01:10:41.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one of a set of pinned certificates, there are certain implementation errors such as a lack of hostname verification. NOTE: this is an end-of-life product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twitter-archive/twitter-kit-ios/blob/ac42e1351a66afa5ff7718d04d64a905dafe1f41/TwitterCore/TwitterCore/Networking/Security/TWTRServerTru
/twitter-kit-ios/blob/ac42e1351a66afa5ff7718d04d64a905dafe1f41/TwitterCore/TwitterCore/Networking/Security/TWTRServerTrustEvaluator.m#L75-L81 - https://www.sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_TwitterKit_for_iOS_CVE-2019-16263.pdf - https://blog.appicaptor.com/2019/10/04/vulnerable-library-warning-twitterkit-for-ios/
CVE ID: CVE-2019-16264 State: PUBLISHED Published: 2019-09-16T12:04:48 Last Updated: 2024-08-05T01:10:41.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database. Additional Analyst Notes: - CVE Program Container: References: - https://infayer.com/?p=43
CVE ID: CVE-2019-16265 State: PUBLISHED Published: 2019-10-25T16:34:57 Last Updated: 2024-08-05T01:10:41.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.codesys.com - https://customers.codesys.com/fileadmin/data/customers/security/2019/Advisory2019-09_LCDS-319.pdf
CVE ID: CVE-2019-16268 State: PUBLISHED Published: 2021-02-03T17:55:06 Last Updated: 2024-08-05T01:10:41.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16268-html-injection-vulnerability-in-manageengine-remote-access-plus/ - https://www.manageengine.com/remote-desktop-management/knowledge-base/html-injection.html
CVE ID: CVE-2019-16271 State: PUBLISHED Published: 2020-01-06T20:02:46 Last Updated: 2024-08-05T01:10:41.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/company/blog/dten-vulnerability/
CVE ID: CVE-2019-16272 State: PUBLISHED Published: 2020-01-06T19:58:48 Last Updated: 2024-08-05T01:10:41.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/company/blog/dten-vulnerability/
CVE ID: CVE-2019-16273 State: PUBLISHED Published: 2020-01-06T19:55:50 Last Updated: 2024-08-05T01:10:41.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code execution and system administration. Also, this provides a covert ability to capture screen data from the Zoom Client on Windows by executing commands on the Android OS. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/company/blog/dten-vulnerability/
CVE ID: CVE-2019-16274 State: PUBLISHED Published: 2020-01-06T19:52:35 Last Updated: 2024-08-05T01:10:41.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/company/blog/dten-vulnerability/
CVE ID: CVE-2019-16275 State: PUBLISHED Published: 2019-09-12T19:07:09 Last Updated: 2024-08-05T01:10:41.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/09/11/7 - https://w1.fi/security/201
E Program Container: References: - https://www.openwall.com/lists/oss-security/2019/09/11/7 - https://w1.fi/security/2019-7/ - https://w1.fi/security/2019-7/ap-mode-pmf-disconnection-protection-bypass.txt - http://www.openwall.com/lists/oss-security/2019/09/12/6 - https://lists.debian.org/debian-lts-announce/2019/09/msg00017.html - https://usn.ubuntu.com/4136-1/ - https://usn.ubuntu.com/4136-2/ - https://www.debian.org/security/2019/dsa-4538 - https://seclists.org/bugtraq/2019/Sep/56 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36G4XAZ644DMHBLKOL4FDSPZVIGNQY6U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
message/36G4XAZ644DMHBLKOL4FDSPZVIGNQY6U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FEGITWRTIWABW54ANEPCEF4ARZLXGSK5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBJXUKV6XMSELWNXPS37CSUIH5EUHFXQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7NCLOPTZNRRNYODH22BFIDH6YIQWLJD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY6STGJIIROVNIU6VMB2WTN2Q5M65WF4/
CVE ID: CVE-2019-16276 State: PUBLISHED Published: 2019-09-30T18:40:12 Last Updated: 2024-08-05T01:10:41.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/34540 - https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/ -
.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html - https://security.netapp.com/advisory/ntap-20191122-0004/ - https://access.redhat.com/errata/RHSA-2020:0101 - https://access.redhat.com/errata/RHSA-2020:0329 - https://access.redhat.com/errata/RHSA-2020:0652 - https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html - https://lists.d
.redhat.com/errata/RHSA-2020:0652 - https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
CVE ID: CVE-2019-16277 State: PUBLISHED Published: 2019-09-13T11:07:00 Last Updated: 2024-08-05T01:10:41.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/zsaleeba/picoc/issues/44
CVE ID: CVE-2019-16278 State: PUBLISHED Published: 2019-10-14T16:06:03.000Z Last Updated: 2025-10-21T23:45:29.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.nazgul.ch/dev/nostromo_cl.txt - https://sp0re.sh - https://git.sp0re.sh/sp0re/Nhttpd-exploits - http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html - http://packetstormsecurity.com/files/155802/nostromo-1.9.
romo-1.9.6-Directory-Traversal-Remote-Command-Execution.html - http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
CVE ID: CVE-2019-16279 State: PUBLISHED Published: 2019-10-14T16:01:11 Last Updated: 2024-08-05T01:10:41.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.nazgul.ch/dev/nostromo_cl.txt - https://sp0re.sh - https://git.sp0re.sh/sp0re/Nhttpd-exploits
CVE ID: CVE-2019-16281 State: PUBLISHED Published: 2020-12-30T20:12:30 Last Updated: 2024-08-05T01:10:41.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nayutaco/ptarmigan/compare/v0.2.2...v0.2.3 - https://github.com/nayutaco/ptarmigan/releases/tag/v0.2.3 - https://github.com/nayutaco/ptarmigan/commit/37fd8f9da3bab9d323ddd77f2fd20b6dde8bcf6c
CVE ID: CVE-2019-16282 State: PUBLISHED Published: 2019-10-14T17:02:37 Last Updated: 2024-08-05T01:10:41.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47496
CVE ID: CVE-2019-16283 State: PUBLISHED Published: 2023-06-09T17:29:29.285Z Last Updated: 2025-01-06T18:12:10.340Z Vendors: HP Inc. Products: HP Softpaq installer Description: A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/c06541912
CVE ID: CVE-2019-16284 State: PUBLISHED Published: 2019-11-05T20:16:57 Last Updated: 2024-08-05T01:10:41.768Z Vendors: HP Inc. Products: Multiple - See https://support.hp.com/rs-en/document/c06456250 Problem Types: Elevation of privilege Description: A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot services that can result in elevation of privilege. The EFI_BOOT_SERVICES structure might be overwritten by an attacker to execute arbitrary SMM (System Management Mode) code. A list of affected products and versions are available in https://support.hp.com/rs-en/document/c06456250. Additional
e. A list of affected products and versions are available in https://support.hp.com/rs-en/document/c06456250. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/rs-en/document/c06456250
CVE ID: CVE-2019-16285 State: PUBLISHED Published: 2019-11-22T21:44:22 Last Updated: 2024-08-05T01:10:41.721Z Vendors: HP Products: ThinPro Linux Problem Types: Information disclosure. Description: If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/30 - http://packetstormsecurity.com/files/156895/HP-ThinPro-6.x-7.x-Information-Disclosure.html
CVE ID: CVE-2019-16286 State: PUBLISHED Published: 2019-11-22T21:49:18 Last Updated: 2024-08-05T01:10:41.697Z Vendors: HP Products: ThinPro Linux Problem Types: Application filter bypass and arbitrary command execution. Description: An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/37 - http://packetstormsecurity.com/files/156898/HP-ThinPro-6.x-7.x-Filter-Bypass.html
CVE ID: CVE-2019-16287 State: PUBLISHED Published: 2019-11-22T21:30:53 Last Updated: 2024-08-05T01:10:41.709Z Vendors: HP Products: ThinPro Linux Problem Types: Privilege Escalation Description: In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose presence puts the device in Administrative Mode, which will allow the attacker to executed commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/38 - http://packetsto
s: - https://support.hp.com/us-en/document/c06509350 - http://seclists.org/fulldisclosure/2020/Mar/38 - http://packetstormsecurity.com/files/156899/HP-ThinPro-6.x-7.x-Privilege-Escalation.html