Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18642 State: PUBLISHED Published: 2021-01-07T20:45:46 Last Updated: 2024-08-05T01:54:14.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and use of sequential user IDs allows any user to change account details of any other user. This vulnerability could be used to change the email address of another account, even the administrator account. Upon changing another account's email address, performing a password reset to the new email address could allow an attacker to take over any account. Additional Analyst N
forming a password reset to the new email address could allow an attacker to take over any account. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html
CVE ID: CVE-2019-18643 State: PUBLISHED Published: 2021-01-07T20:45:41 Last Updated: 2024-08-05T01:54:14.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to upload ASPX code and gain remote code execution on the application. The application typically runs as LocalSystem as mandated in the installation guide. Patched in versions 8.10 and 9.4. Additional Analyst Notes: - CVE Program Container:
andated in the installation guide. Patched in versions 8.10 and 9.4. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html
CVE ID: CVE-2019-18644 State: PUBLISHED Published: 2019-10-30T23:07:51 Last Updated: 2024-08-05T01:54:14.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow privileged files to be deleted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Privileged%20File%20Delete/v11.5.2.28/README.md
CVE ID: CVE-2019-18645 State: PUBLISHED Published: 2019-10-30T23:07:35 Last Updated: 2024-08-05T01:54:14.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/Total%20Defense/Local%20Privilege%20Escalation/v11.5.2.28/README.md
CVE ID: CVE-2019-18646 State: PUBLISHED Published: 2019-11-14T14:17:19 Last Updated: 2024-08-05T01:54:14.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145
CVE ID: CVE-2019-18647 State: PUBLISHED Published: 2019-11-14T14:16:24 Last Updated: 2024-08-05T01:54:14.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145
CVE ID: CVE-2019-18648 State: PUBLISHED Published: 2019-11-14T14:13:44 Last Updated: 2024-08-05T01:54:14.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145
CVE ID: CVE-2019-18649 State: PUBLISHED Published: 2019-11-14T14:03:06 Last Updated: 2024-08-05T01:54:14.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145
CVE ID: CVE-2019-18650 State: PUBLISHED Published: 2019-11-06T01:35:13 Last Updated: 2024-08-05T01:54:14.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/794-20191001-core-csrf-in-com-template-overrides-view.html
CVE ID: CVE-2019-18651 State: PUBLISHED Published: 2019-11-14T20:39:24 Last Updated: 2024-08-05T01:54:14.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document or encoded URL to a user that the website trusts. The user needs to have an active privileged session. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/crypt0crc/cve-2019-18651
CVE ID: CVE-2019-18652 State: PUBLISHED Published: 2020-01-07T21:40:50 Last Updated: 2024-08-05T01:54:14.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and Microsoft Edge 44.18362.387.0 (Microsoft EdgeHTML 18.18362). Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/crypt0crc/cve-2019-18652
CVE ID: CVE-2019-18653 State: PUBLISHED Published: 2019-11-01T18:25:08 Last Updated: 2024-08-05T01:54:14.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968 - http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/
CVE ID: CVE-2019-18654 State: PUBLISHED Published: 2019-11-01T18:25:52 Last Updated: 2024-08-05T01:54:14.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40YoKoKho/5-000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop-1e99375f0968 - http://firstsight.me/2019/10/5000-usd-xss-issue-at-avast-desktop-antivirus-for-windows-yes-desktop/
CVE ID: CVE-2019-18655 State: PUBLISHED Published: 2019-11-12T16:11:07 Last Updated: 2024-10-08T15:38:34.116616 Vendors: n/a Products: n/a Problem Types: n/a Description: File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the URL. A similar issue to CVE-2019-17415, CVE-2019-16724, and CVE-2010-2331. Additional Analyst Notes: - CVE Program Container: References: - http://0xhuesca.com/cve-2019-18655.html - https://www.0xhuesca.com/2019/11/cve-2019-18655.htm
m Container: References: - http://0xhuesca.com/cve-2019-18655.html - https://www.0xhuesca.com/2019/11/cve-2019-18655.html - https://github.com/0xhuesca/CVE-2019-18655/blob/main/filesharing_wizard_get_bof.rb
CVE ID: CVE-2019-18656 State: PUBLISHED Published: 2019-10-31T16:41:22 Last Updated: 2024-08-05T01:54:14.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/pimcore/commit/ca036e9f86bb5cdb3dac0930ec131e5f35e26c5f
CVE ID: CVE-2019-18657 State: PUBLISHED Published: 2019-10-31T18:55:55 Last Updated: 2024-08-05T01:54:14.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClickHouse/ClickHouse/pull/6466 - https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md - https://github.com/ClickHouse/ClickHouse/pull/7526/files
CVE ID: CVE-2019-18658 State: PUBLISHED Published: 2019-11-12T13:20:13 Last Updated: 2024-08-05T01:54:14.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue. Additional Analyst Notes: - CVE Program Container: References: - https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/
CVE ID: CVE-2019-18659 State: PUBLISHED Published: 2019-11-02T00:49:21 Last Updated: 2024-08-05T01:54:14.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonstrated by MessageIdentifier 4370 in LTE System Information Block 12 (aka SIB12). NOTE: testing inside an RF-isolated shield box suggested that all LTE phones are affected by design (e.g., use of Android versus iOS does not matter); testing in an open RF environment is, of course, contraindicated. Additional Analyst Notes: - CVE Program Container: References: - https://dl
environment is, of course, contraindicated. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/citation.cfm?id=3326082
CVE ID: CVE-2019-18660 State: PUBLISHED Published: 2019-11-27T22:11:42 Last Updated: 2024-08-05T01:54:14.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/11/27/1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad - http://www.openwall.com/lists/oss
ux/kernel/git/torvalds/linux.git/commit/?id=39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad - http://www.openwall.com/lists/oss-security/2019/11/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYIFGYEDQXP5DVJQQUARQRK2PXKBKQGY/ - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWWOOJKZ4NQYN4RMFIVJ3ZIXKJJI3MKP/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4228-1/ - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4
dvisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4228-1/ - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https://usn.ubuntu.com/4225-1/ - https://usn.ubuntu.com/4228-2/ - https://usn.ubuntu.com/4227-2/ - https://seclists.org/bugtraq/2020/Jan/10 - http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://access.redhat.com/errata/RHSA-2020:0174 - https://usn.ubuntu.com/4225-2/
CVE ID: CVE-2019-18661 State: PUBLISHED Published: 2019-11-02T01:17:12 Last Updated: 2024-08-05T01:54:14.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0 to 1. An attack does not achieve administrative control of a device; however, the attacker can view all of the web pages of the administration console. Additional Analyst Notes: - CVE Program Container: References: - https://angeloanatrella86.github.io/CVE-2019/ - https://github.com/angeloanatrella86/CVE-2019/blob/master/index.md
CVE ID: CVE-2019-18662 State: PUBLISHED Published: 2019-11-02T14:06:20 Last Updated: 2024-08-05T01:54:14.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query. This can be exploited by malicious users to, e.g., read sensitive data from the database through in-band SQL Injection attacks. Successful exploitation of this vulnerability requires the Live Chat plugin to be enabled. Additional Analyst Notes: - CVE
cessful exploitation of this vulnerability requires the Live Chat plugin to be enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/YouPHPTube/YouPHPTube/issues/2202 - http://seclists.org/fulldisclosure/2019/Dec/9 - http://packetstormsecurity.com/files/155564/YouPHPTube-7.7-SQL-Injection.html
CVE ID: CVE-2019-18663 State: PUBLISHED Published: 2019-11-04T19:08:13 Last Updated: 2024-08-05T01:54:14.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://atomic111.github.io/article/arp-guard-sql-injection
CVE ID: CVE-2019-18664 State: PUBLISHED Published: 2019-11-02T14:28:21 Last Updated: 2024-08-05T01:54:14.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Log module in SECUDOS DOMOS before 5.6 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6 - https://atomic111.github.io/article/secudos-domos-reflected-xss
CVE ID: CVE-2019-18665 State: PUBLISHED Published: 2019-11-02T14:28:11 Last Updated: 2024-08-05T01:54:14.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://www.secudos.de/news-und-events/aktuelle-news/domos-release-5-6 - https://atomic111.github.io/article/secudos-domos-directory_traversal
CVE ID: CVE-2019-18666 State: PUBLISHED Published: 2020-05-15T17:18:44 Last Updated: 2024-08-05T01:54:14.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization. Additional Analy
1, the root credentials were changed but the telnet service can still be started without authorization. Additional Analyst Notes: - CVE Program Container: References: - http://c1a.eu/dlink-dap-1360.html - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10171 - https://daschloer.github.io/sec/dlink-dap-1360.html
CVE ID: CVE-2019-18667 State: PUBLISHED Published: 2019-11-02T15:07:51 Last Updated: 2024-08-05T01:54:14.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pfsense/FreeBSD-ports/commit/30b22b6b0db7b73732a5da346afca66dc244e02a
CVE ID: CVE-2019-18668 State: PUBLISHED Published: 2019-11-02T15:29:16 Last Updated: 2024-08-05T01:54:14.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price. Additional Analyst Notes: - CVE Program Container: R
can eventually purchase an item for a significantly cheaper price. Additional Analyst Notes: - CVE Program Container: References: - https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61 - https://wordpress.org/plugins/currency-switcher-woocommerce/#developers - https://wpvulndb.com/vulnerabilities/9936
CVE ID: CVE-2019-18670 State: PUBLISHED Published: 2019-12-17T15:10:05 Last Updated: 2024-08-05T01:54:14.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM. This is a DLL Hijacking vulnerability (including search order hijacking, which searches for the missing DLL in the PATH environment variable), which is caused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll. Additional Analyst Notes: - C
aused by an uncontrolled search path element for nvapi.dll, atiadlxx.dll, or atiadlxy.dll. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/open?id=1r0cr-H_FMc8V4hwlqF1MAEhSSnztm5sp - https://us.answers.acer.com/app/answers/detail/a_id/64586
CVE ID: CVE-2019-18671 State: PUBLISHED Published: 2019-12-06T17:53:29 Last Updated: 2024-08-05T01:54:14.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment via crafted messages. The vulnerability could allow code execution or other forms of impact. It can be triggered by unauthenticated attackers and the interface is reachable via WebUSB. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3 - https://medium.com/shapeshift
ps://github.com/keepkey/keepkey-firmware/commit/b222c66cdd7c3203d917c80ba615082d309d80c3 - https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 - https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 - https://blog.inhq.net/posts/keepkey-CVE-2019-18671/
CVE ID: CVE-2019-18672 State: PUBLISHED Published: 2019-12-06T17:54:54 Last Updated: 2024-08-05T01:54:14.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets to known values via crafted messages. Notably, this breaks the security of U2F for new server registrations and invalidates existing registrations. This vulnerability can be exploited by unauthenticated attackers and the interface is reachable via WebUSB. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/shapeshift-stories/keepkey-relea
SB. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/shapeshift-stories/keepkey-release-notes-v-6f7d2ec78065 - https://github.com/keepkey/keepkey-firmware/commit/769714fcb569e7a4faff9530a2d9ac1f9d6e5680 - https://medium.com/shapeshift-stories/shapeshift-security-update-8ec89bb1b4e3 - https://blog.inhq.net/posts/keepkey-CVE-2019-18672/
CVE ID: CVE-2019-18673 State: PUBLISHED Published: 2019-11-02T16:25:42 Last Updated: 2024-08-05T01:54:14.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. Note: BIP39 secrets are not displayed by default on this device. The side channel is relevant only if the attacker has enough control over the
e not displayed by default on this device. The side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. Additional Analyst Notes: - CVE Program Container: References: - https://blog.inhq.net/posts/oled-side-channel-status-summary/
CVE ID: CVE-2019-18674 State: PUBLISHED Published: 2019-11-06T01:34:16 Last Updated: 2024-08-05T01:54:14.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/795-20191002-core-path-disclosure-in-phpuft8-mapping-files.html
CVE ID: CVE-2019-18675 State: PUBLISHED Published: 2019-11-25T13:44:26 Last Updated: 2024-08-05T01:54:14.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/media/usb/cpia2/cpia2_core.c - https://