Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6289 State: PUBLISHED Published: 2019-01-15T06:00:00 Last Updated: 2024-08-04T20:16:24.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename. Additional Analyst Notes: - CVE Program Container: References: - https://laolisafe.com/dedecms/
CVE ID: CVE-2019-6290 State: PUBLISHED Published: 2019-01-15T00:00:00Z Last Updated: 2024-09-16T16:38:59.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem resulting from infinite recursion in the functions expr, rexp, bexpr and cexpr in certain scenarios involving lots of '{' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392548
CVE ID: CVE-2019-6291 State: PUBLISHED Published: 2019-01-15T00:00:00Z Last Updated: 2024-09-16T23:45:29.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 function making recursive calls to itself in certain scenarios involving lots of '!' or '+' or '-' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392549
CVE ID: CVE-2019-6292 State: PUBLISHED Published: 2019-01-15T00:00:00Z Last Updated: 2024-09-16T17:19:09.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jbeder/yaml-cpp/issues/657
CVE ID: CVE-2019-6293 State: PUBLISHED Published: 2019-01-15T00:00:00Z Last Updated: 2024-09-16T22:30:16.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/westes/flex/issues/414
CVE ID: CVE-2019-6294 State: PUBLISHED Published: 2019-01-15T14:00:00 Last Updated: 2024-08-04T20:16:24.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamEasy/EasyCMS/issues/8
CVE ID: CVE-2019-6295 State: PUBLISHED Published: 2019-01-15T14:00:00Z Last Updated: 2024-09-16T20:32:11.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yanchongchong/swallow/issues/12
CVE ID: CVE-2019-6296 State: PUBLISHED Published: 2019-01-15T14:00:00Z Last Updated: 2024-09-16T20:22:48.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yanchongchong/swallow/issues/13
CVE ID: CVE-2019-6318 State: PUBLISHED Published: 2019-04-11T14:45:48 Last Updated: 2024-08-04T20:16:24.822Z Vendors: HP Products: HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers Problem Types: Execution of arbitrary code. Description: HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insufficient solution bundle signature validation that potentially allows execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06265454
CVE ID: CVE-2019-6319 State: PUBLISHED Published: 2020-01-09T19:04:25 Last Updated: 2024-08-04T20:16:24.796Z Vendors: HP Inc. Products: HP DeskJet 3630 All-in-One Printer series Problem Types: Cross-Site Request Forgery in HP DeskJet 3630 Printers Description: HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial of service (DOS) or device misconfiguration. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06308143
CVE ID: CVE-2019-6320 State: PUBLISHED Published: 2020-01-09T18:59:47 Last Updated: 2024-08-04T20:16:24.791Z Vendors: HP Inc. Products: HP DeskJet 3630 All-in-One Printer series Problem Types: Cross-Site Request Forgery in HP DeskJet 3630 Printers Description: Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial of service (DOS) or device misconfiguration. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06308143
CVE ID: CVE-2019-6321 State: PUBLISHED Published: 2019-05-29T19:55:14 Last Updated: 2024-08-04T20:16:24.882Z Vendors: n/a Products: HP Z4 G4 Workstation (Xeon W), HP Z4 G4 Workstation (Xeon W) (Linux), HP Z4 G4 Core-X Workstation, HP Z4 G4 Core-X Workstation (Linux), HP Z6 G4 Workstation, HP Z6 G4 Workstation (Linux), HP Z8 G4 Workstation, HP Z8 G4 Workstation (Linux) Problem Types: Escalation of Privilege, Denial of Service, Information Disclosure, Loss of Confidentiality, Loss of Integrity Description: HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerabilit
tation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is disabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06318199
CVE ID: CVE-2019-6322 State: PUBLISHED Published: 2019-05-29T19:56:26 Last Updated: 2024-08-04T20:16:24.814Z Vendors: n/a Products: HP Z4 G4 Workstation (Xeon W), HP Z4 G4 Workstation (Xeon W) (Linux), HP Z4 G4 Core-X Workstation, HP Z4 G4 Core-X Workstation (Linux), HP Z6 G4 Workstation, HP Z6 G4 Workstation (Linux), HP Z8 G4 Workstation, HP Z8 G4 Workstation (Linux) Problem Types: Escalation of Privilege, Denial of Service, Information Disclosure, Loss of Confidentiality, Loss of Integrity Description: HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerabilit
tation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This vulnerability relates to Workstations whose TPM is enabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06318199
CVE ID: CVE-2019-6323 State: PUBLISHED Published: 2019-06-17T15:55:05 Last Updated: 2024-08-04T20:16:24.740Z Vendors: n/a Products: HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Problem Types: Reflected XSS. Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06356322
CVE ID: CVE-2019-6324 State: PUBLISHED Published: 2019-06-17T15:55:14 Last Updated: 2024-08-04T20:16:24.805Z Vendors: n/a Products: HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Problem Types: Stored XSS. Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06356322
CVE ID: CVE-2019-6325 State: PUBLISHED Published: 2019-06-17T15:55:24 Last Updated: 2024-08-04T20:16:24.849Z Vendors: n/a Products: HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Problem Types: CSRF. Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06356322
CVE ID: CVE-2019-6326 State: PUBLISHED Published: 2019-06-17T15:55:30 Last Updated: 2024-08-04T20:16:24.828Z Vendors: n/a Products: HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Problem Types: Buffer overflow. Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have embedded web server attributes which may be potentially vulnerable to Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06356322
CVE ID: CVE-2019-6327 State: PUBLISHED Published: 2019-06-17T15:55:40 Last Updated: 2024-08-04T20:16:24.816Z Vendors: n/a Products: HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Problem Types: Buffer overflow. Description: HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an IPP Parser potentially vulnerable to Buffer Overflow. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06356322
CVE ID: CVE-2019-6328 State: PUBLISHED Published: 2019-06-25T16:23:47 Last Updated: 2024-08-04T20:16:24.823Z Vendors: HP Products: HP Support Assistant Problem Types: Elevation of Privilege Description: HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6329. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06388027 - http://www.securityfocus.com/bid/108891
CVE ID: CVE-2019-6329 State: PUBLISHED Published: 2019-06-25T16:24:33 Last Updated: 2024-08-04T20:16:24.843Z Vendors: HP Products: HP Support Assistant Problem Types: Elevation of Privilege Description: HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6328. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06388027 - http://www.securityfocus.com/bid/108891
CVE ID: CVE-2019-6330 State: PUBLISHED Published: 2020-01-09T18:37:31 Last Updated: 2024-08-04T20:16:24.831Z Vendors: n/a Products: HP Access Control Problem Types: Elevation of privilege vulnerability is found in HP Access Control Description: A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. This vulnerability could potentially grant elevation of privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/in-en/document/c06463137
CVE ID: CVE-2019-6331 State: PUBLISHED Published: 2020-01-09T18:28:51 Last Updated: 2024-08-04T20:16:24.789Z Vendors: n/a Products: Samsung Mobile Print (Android) Problem Types: Exposure of Application Configuration Details in Samsung Mobile Print (Android) Description: An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/in-en/document/c06424557
CVE ID: CVE-2019-6332 State: PUBLISHED Published: 2020-01-09T18:23:38 Last Updated: 2024-08-04T20:16:24.804Z Vendors: HP Inc. Products: HP DeskJet 2600 All-in-One Printer series, HP DeskJet Ink Advantage 2600 All-in-One Printer series, HP DeskJet Ink Advantage 5000 All-in-One Printer series, HP DeskJet Ink Advantage 5200 All-in-One Printer series, HP ENVY 5000 All-in-One Printer series, HP ENVY Photo 6200 All-in-One Printer series, HP ENVY Photo 7100 All-in-One Printer series, HP ENVY Photo 7800 All-in-One Printer series, HP Ink Tank Wireless 410 series, HP OfficeJet 5200 All-in-One Printer series, HP Smart Tank Wireless 450 series Problem Types: Cross-site Scripting (XSS) in HP InkJet Print
ll-in-One Printer series, HP Smart Tank Wireless 450 series Problem Types: Cross-site Scripting (XSS) in HP InkJet Printers Description: A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS). Affected products and versions include: HP DeskJet 2600 All-in-One Printer series model numbers 4UJ28B, V1N01A - V1N08A, Y5H60A - Y5H80A; HP DeskJet Ink Advantage 2600 All-in-One Printer series model numbers V1N02A - V1N02B, Y5Z00A - Y5Z04B; HP DeskJet Ink Advantage 5000 All-in-One Printer series model numbers M2U86A - M2U89B; HP DeskJet Ink Advantage 5200 All-in-One Printer series model numbers M2
e Printer series model numbers M2U86A - M2U89B; HP DeskJet Ink Advantage 5200 All-in-One Printer series model numbers M2U76A - M2U78B; HP ENVY 5000 All-in-One Printer series model numbers M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A; HP ENVY Photo 6200 All-in-One Printer series model numbers K7G18A-K7G26B, K7S21B, Y0K13D - Y0K15A; HP ENVY Photo 7100 All-in-One Printer series model numbers 3XD89A, K7G93A-K7G99A, Z3M37A - Z3M52A; HP ENVY Photo 7800 All-in-One Printer series model numbers K7R96A, K7S00A - K7S10D, Y0G42D - Y0G52B; HP Ink Tank Wireless 410 series model numbers Z4B53A - Z4B55A, Z6Z95A - Z6Z99A, 4DX94A - 4DX95A, 4YF79A, Z7A01A; HP OfficeJet 5200 All-in-One Printer series model
ers Z4B53A - Z4B55A, Z6Z95A - Z6Z99A, 4DX94A - 4DX95A, 4YF79A, Z7A01A; HP OfficeJet 5200 All-in-One Printer series model numbers M2U75A, M2U81A-M2U84B, Z4B12A - Z4B14A, Z4B27A - Z4B29A; HP Smart Tank Wireless 450 series model numbers Z4B56A, Z6Z96A - Z6Z98A. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/in-en/document/c06428029
CVE ID: CVE-2019-6333 State: PUBLISHED Published: 2019-10-11T16:06:27 Last Updated: 2024-08-04T20:16:24.821Z Vendors: HP Products: Touchpoint Analytics Problem Types: Execution of arbitrary code. Description: A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. This vulnerability may allow a local attacker with administrative privileges to execute arbitrary code via an HP Touchpoint Analytics system service. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/Post/HP-Touchpoint-Analytics-DLL-Search-Order-Hijacking-Potential-Abuses-CVE-2019-6333 - https://support.hp.com/us-en/do
Post/HP-Touchpoint-Analytics-DLL-Search-Order-Hijacking-Potential-Abuses-CVE-2019-6333 - https://support.hp.com/us-en/document/c06463166
CVE ID: CVE-2019-6334 State: PUBLISHED Published: 2019-10-16T14:16:49 Last Updated: 2024-08-04T20:16:24.816Z Vendors: n/a Products: HP Color LaserJet CM4540 MFP,HP Color LaserJet Managed flow MFP M880zm,HP Color LaserJet Enterprise flow MFP M880z,HP Color LaserJet Enterprise M552,HP Color LaserJet Managed M553,HP Color LaserJet Enterprise M553,HP Color LaserJet Managed M651,HP Color LaserJet Enterprise M651,HP Color LaserJet Enterprise M652,HP Color LaserJet Enterprise M653,HP Color LaserJet Enterprise M750,HP Color LaserJet Managed E75245,HP Color LaserJet Enterprise M751,HP Color LaserJet Enterprise M855,HP Color LaserJet Enterprise Flow MFP M577,HP Color LaserJet Enterprise MFP M577,HP Co
HP Color LaserJet Enterprise M855,HP Color LaserJet Enterprise Flow MFP M577,HP Color LaserJet Enterprise MFP M577,HP Color LaserJet Enterprise Flow MFP M680,HP Color LaserJet Enterprise MFP M680,HP Color LaserJet Enterprise flow MFP M681,HP Color LaserJet Enterprise MFP M681,HP Color LaserJet Enterprise flow MFP M682,HP Color LaserJet Enterprise MFP M682,HP Color LaserJet Enterprises CP5525,HP Color LaserJet Managed E55040dw,HP Color LaserJet Managed E65050/60,HP Color LaserJet Managed flow MFP E77822/25/30,HP Color LaserJet Managed flow MFP E57540,HP Color LaserJet Managed MFP E57540,HP Color LaserJet Managed flow MFP E67550/60,HP Color LaserJet Managed MFP E67550/60,HP Color LaserJet Mana
d MFP E57540,HP Color LaserJet Managed flow MFP E67550/60,HP Color LaserJet Managed MFP E67550/60,HP Color LaserJet Managed MFP E77422/28,HP Color LaserJet Managed MFP E77822/25/30,HP Color LaserJet Managed flow MFP E87640/50/60,HP Color LaserJet Managed MFP E87640/50/60,HP Color LaserJet Managed Flow MFP M577,HP Color LaserJet Managed MFP M577,HP Color LaserJet Managed Flow MFP M680,HP Color LaserJet Managed MFP M680,HP LaserJet Enterprise 500 Color M551HP LaserJet Enterprise color flow MFP M575,HP LaserJet Enterprise 500 color MFP M575,HP LaserJet Enterprise Flow MFP M525,HP LaserJet Enterprise 500 MFP M525f,HP LaserJet Enterprise 600 M601,HP LaserJet Enterprise 600 M602,HP LaserJet Enterp
,HP LaserJet Enterprise 500 MFP M525f,HP LaserJet Enterprise 600 M601,HP LaserJet Enterprise 600 M602,HP LaserJet Enterprise 600 M603,HP Color LaserJet Managed MFP M775,HP LaserJet Enterprise 700 color MFP M775,HP LaserJet Enterprise 700 M712,HP LaserJet Managed flow MFP M630,HP LaserJet Enterprise flow MFP M630,HP LaserJet Managed flow MFP M830,HP LaserJet Enterprise flow MFP M830,HP LaserJet Enterprise M4555 MFP,HP Las ...[truncated*] Problem Types: Execution of arbitrary code Description: HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Managed Printers have a solution to check application signature that may allow potential execution of arbitrary code. Additional Analyst Notes: -
olution to check application signature that may allow potential execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06447795
CVE ID: CVE-2019-6335 State: PUBLISHED Published: 2019-10-11T17:34:56 Last Updated: 2024-08-04T20:16:24.812Z Vendors: Samsung Products: Laser Printers Problem Types: Denial of Service Description: A potential security vulnerability has been identified with Samsung Laser Printers. This vulnerability could potentially be exploited to create a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/hr-en/document/c06461713
CVE ID: CVE-2019-6337 State: PUBLISHED Published: 2019-11-07T14:37:09 Last Updated: 2024-08-04T20:16:24.827Z Vendors: n/a Products: HP OfficeJet Pro 8210 Printer series,HP PageWide 352dw Printer,HP PageWide 377dw Multifunction Printer,HP PageWide Managed P55250dw Printer series,HP PageWide Managed P57750dw Multifunction Printer series,HP PageWide Managed P52750dw Multifunction Printer,HP PageWide Pro 452dn Printer series,HP PageWide Pro 452dw Printer series,HP PageWide Pro 477dn Multifunction Printer series,HP PageWide Pro 477dw Multifunction Printer series,HP PageWide Pro 552dw Printer series,HP PageWide Pro 577dw Multifunction Printer series Problem Types: Buffer Overflow, Disclosure of In
552dw Printer series,HP PageWide Pro 577dw Multifunction Printer series Problem Types: Buffer Overflow, Disclosure of Information Description: For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert. Under certain circumstances, the printer produces a core dump to a local device. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06458150
CVE ID: CVE-2019-6338 State: PUBLISHED Published: 2019-01-22T15:00:00Z Last Updated: 2024-09-16T18:38:30.675Z Vendors: Drupal Products: Drupal core Problem Types: 3rd party library weekness Description: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2019-001 - https://www.debian.org/security/2019/dsa-4370 - https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html -
- https://www.debian.org/security/2019/dsa-4370 - https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html - http://www.securityfocus.com/bid/106706
CVE ID: CVE-2019-6339 State: PUBLISHED Published: 2019-01-22T15:00:00Z Last Updated: 2024-09-16T20:06:38.516Z Vendors: Drupal Products: Drupal core Problem Types: Remote Code Execution Description: In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administ
vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4370 - https://www.drupal.org/sa-core-2019-002 - https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html
CVE ID: CVE-2019-6340 State: PUBLISHED Published: 2019-02-21T21:00:00.000Z Last Updated: 2025-10-21T23:45:43.200Z Vendors: Drupal Products: Drupal Core Problem Types: Remote code execution Description: Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Dru