Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-8287 State: PUBLISHED Published: 2019-10-29T16:43:30 Last Updated: 2024-08-04T21:17:31.162Z Vendors: Kaspersky Products: TightVNC Problem Types: CWE-120 Description: TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/12/10/5 - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE ID: CVE-2019-8288 State: PUBLISHED Published: 2019-10-01T19:53:28 Last Updated: 2024-08-04T21:17:30.693Z Vendors: abcprintf Products: Online Store Problem Types: Online store system v1.0 Stored XSS Description: Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=210 - https://www.abcprintf.com/view_download.php?id=17 - http://www.openwall.com/lists/oss-security/2019/10/02/1
CVE ID: CVE-2019-8289 State: PUBLISHED Published: 2019-10-01T19:53:28 Last Updated: 2024-08-04T21:17:31.149Z Vendors: abcprintf Products: Online Store Problem Types: Online store system v1.0 Stored XSS. Description: Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=210 - https://www.abcprintf.com/view_download.php?id=17 - http://www.openwall.com/lists/oss-security/2019/10/02/1
CVE ID: CVE-2019-8290 State: PUBLISHED Published: 2019-10-01T19:53:28 Last Updated: 2024-08-04T21:17:30.470Z Vendors: abcprintf Products: Online Store Problem Types: User input not sanitized in sent_register.php. Description: Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php allowing special characters to be included and an XSS payload to be injected. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=210 - https://www.abcprintf.com/view_download.php?id=17 - http://www.openwall.com/lists/oss-security/2019/10/02/1
CVE ID: CVE-2019-8291 State: PUBLISHED Published: 2019-10-01T19:53:28 Last Updated: 2024-08-04T21:17:31.357Z Vendors: abcprintf Products: Online Store Problem Types: unauthenticated arbitrary file deletions via path traversal Description: Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=210 - https://www.abcprintf.com/view_download.php?id=17 - http://www.openwall.com/lists/oss-security/2019/10/02/1
CVE ID: CVE-2019-8292 State: PUBLISHED Published: 2019-10-01T19:53:28 Last Updated: 2024-08-04T21:17:30.505Z Vendors: abcprintf Products: Online Store Problem Types: unauthenticated arbitrary product deletions. Description: Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=210 - https://www.abcprintf.com/view_download.php?id=17 - http://www.openwall.com/lists/oss-security/2019/10/02/1 - http://www.openwall.com/lists/oss-security/2019/12/23/1 - http://www.openwall.com/lists/oss-securit
urity/2019/10/02/1 - http://www.openwall.com/lists/oss-security/2019/12/23/1 - http://www.openwall.com/lists/oss-security/2019/12/23/2
CVE ID: CVE-2019-8293 State: PUBLISHED Published: 2019-12-23T21:45:08 Last Updated: 2024-08-04T21:17:30.524Z Vendors: n/a Products: abcprintf upload-image-with-ajax Problem Types: Arbitrary File Upload Description: Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/abcprintf/upload-image-with-ajax/commit/71436ba5102010397519d4b25ea57591cfb4974c - http://www.openwall.com/lists/oss-security/2019/12/23/2
CVE ID: CVE-2019-8308 State: PUBLISHED Published: 2019-02-12T23:00:00 Last Updated: 2024-08-04T21:17:30.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922059 - https://github.com/flatpak/flatpak/releases/tag/1.2.3 - https://github.com/flatpak/flatpak/releases/tag/1.0.7 - https://access.redhat.com/errata/RHSA-2019:0375 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html
CVE ID: CVE-2019-8312 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-17T03:03:46.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Add
request body for the SetSysLogSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/syslog.md
CVE ID: CVE-2019-8313 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-16T23:11:24.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6Address
request body for the SetIPv6FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv6.md
CVE ID: CVE-2019-8314 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-16T20:13:15.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Addition
quest body for the SetQoSSettings API function, as demonstrated by shell metacharacters in the IPAddress field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/qos.md
CVE ID: CVE-2019-8315 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-17T03:03:40.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4Address
request body for the SetIPv4FirewallSettings API function, as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/firewallv4.md
CVE ID: CVE-2019-8316 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-16T17:28:06.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field
quest body for the SetWebFilterSettings API function, as demonstrated by shell metacharacters in the WebFilterURLs field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/webfilter.md
CVE ID: CVE-2019-8317 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-17T02:27:52.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork f
quest body for the SetStaticRouteIPv6Settings API function, as demonstrated by shell metacharacters in the DestNetwork field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv6.md
CVE ID: CVE-2019-8318 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-16T19:14:40.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort fie
request body for the SetSysEmailSettings API function, as demonstrated by shell metacharacters in the SMTPServerPort field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/mail.md
CVE ID: CVE-2019-8319 State: PUBLISHED Published: 2019-02-13T03:00:00Z Last Updated: 2024-09-16T23:27:08.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field
quest body for the SetStaticRouteIPv4Settings API function, as demonstrated by shell metacharacters in the Gateway field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lieanu/vuls/blob/master/dlink/DIR-878/staticrouterv4.md
CVE ID: CVE-2019-8320 State: PUBLISHED Published: 2019-06-06T14:50:02 Last Updated: 2024-08-04T21:17:31.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data los
m is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/317321 - https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html - https://access.redhat.com/errata/RHSA-2019:1429 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8321 State: PUBLISHED Published: 2019-06-17T19:02:34 Last Updated: 2024-08-04T21:17:30.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/317330 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8322 State: PUBLISHED Published: 2019-06-17T19:02:14 Last Updated: 2024-08-04T21:17:30.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/315087 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8323 State: PUBLISHED Published: 2019-06-17T19:01:32 Last Updated: 2024-08-04T21:17:31.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/315081 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8324 State: PUBLISHED Published: 2019-06-17T18:59:30 Last Updated: 2024-08-04T21:17:31.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/328571 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:1972 - https://lists.d
org/opensuse-security-announce/2019-07/msg00036.html - https://access.redhat.com/errata/RHSA-2019:1972 - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8325 State: PUBLISHED Published: 2019-06-17T18:59:57 Last Updated: 2024-08-04T21:17:30.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/317353 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE ID: CVE-2019-8331 State: PUBLISHED Published: 2019-02-20T16:00:00 Last Updated: 2024-08-04T21:17:31.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107375 - https://seclists.org/bugtraq/2019/May/18 - http://seclists.org/fulldisclosure/2019/May/11 - http://seclists.org/fulldisclosure/2019/May/10 - http://seclists.org/fulldisclosure/2019/May/13 - https://access.redhat.com/errata/RHSA-2019:1456 - https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986
- https://access.redhat.com/errata/RHSA-2019:1456 - https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://access.re
thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3023 - https://access.redhat.com/errata/RHSA-2019:3024 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.htm
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html - https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/twbs/bootstrap/pull/28236 - https://github.com/twbs/bootstrap/releases/tag/v4.3.1 - https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/ - https://github.com/twbs/bootstrap/releases/tag/v3.4.1 - https://support.f5.com/csp/article/K24383845 - https://support.f5.com
://github.com/twbs/bootstrap/releases/tag/v3.4.1 - https://support.f5.com/csp/article/K24383845 - https://support.f5.com/csp/article/K24383845?utm_source=f5support&amp%3Butm_medium=RSS - https://www.tenable.com/security/tns-2021-14
CVE ID: CVE-2019-8334 State: PUBLISHED Published: 2019-02-13T16:00:00Z Last Updated: 2024-09-17T00:25:30.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS]. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/schoolcms/issues/1
CVE ID: CVE-2019-8335 State: PUBLISHED Published: 2019-02-13T16:00:00Z Last Updated: 2024-09-16T16:42:44.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS]. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongfuxiang/schoolcms/issues/1
CVE ID: CVE-2019-8336 State: PUBLISHED Published: 2019-03-05T23:00:00 Last Updated: 2024-08-04T21:17:31.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hashicorp/consul/issues/5423
CVE ID: CVE-2019-8337 State: PUBLISHED Published: 2019-02-13T20:00:00 Last Updated: 2024-08-04T21:17:31.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. Additional Analyst Notes: - CVE Program Container: References: - https://marlam.de/mpop/news/mpop-1-4-3/ - https://marlam.de/msmtp/news/ - https://gitlab.marlam.de/marlam/mpop/commit/b51a6c6b8b83bf0913cc52fa2ff64307e987a5b8
CVE ID: CVE-2019-8338 State: PUBLISHED Published: 2019-05-16T16:02:46 Last Updated: 2024-08-04T21:17:31.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring. Additional Analyst Notes: - CVE Program Cont
th a fake user ID (email address) and injecting it into the user's keyring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Airmail/AirmailPlugIn-Framework/commits/master - http://seclists.org/fulldisclosure/2019/Apr/38 - http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html - https://www.openwall.com/lists/oss-security/2019/04/30/4 - https://github.com/RUB-NDS/Johnny-You-Are-Fired - https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
CVE ID: CVE-2019-8339 State: PUBLISHED Published: 2019-05-17T19:46:27 Last Updated: 2024-08-04T21:17:30.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Falco through 0.14.0. A missing indicator for insufficient resources allows local users to bypass the detection engine. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/falcosecurity/falco/pull/561 - https://www.twistlock.com/labs-blog/falco-vulnerability-cve-2019-8339/ - https://falco.org/docs/event-sources/dropped-events/ - https://sysdig.com/blog/cve-2019-8339-falco-vulnerability/